VigilantMinds Advisory: Opera JPEG Processing Integer Overflow Vulnerability (VMSA-20060621-01)
Opera JPEG Processing Integer Overflow Vulnerability (VMSA-20060621-01)
Summary:
An integer overflow vulnerability exists in the Opera Web Browser due to
the improper handling of JPEG files.
Impact:
Remote Code Execution
Affected Versions:
Opera 8.54 and Earlier
Details:
If excessively large height and width values are specified in certain
fields of a JPEG file, an integer overflow may cause Opera to allocate
insufficient memory for the image. This will lead to a buffer overflow
when the image is loaded into memory, which can be exploited to execute
arbitrary code.
Recommended Actions:
It is recommended that users upgrade to Opera 9.00, which addresses this
vulnerability. Additionally, users should exercise caution while
accessing the web, and should do so from accounts with limited
privileges.
Timeline:
Reported: 4/25/2006
Fixed: 6/20/2006
Credit:
Chris Ries
References:
Opera Website: http://www.opera.com
VigilantMinds Website: http://www.vigilantminds.com