The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Opera

computer vulnerability announce CVE-2018-20346 CVE-2018-20505 CVE-2018-20506

SQLite, Chrome: memory corruption via FTS3 Query

Synthesis of the vulnerability

An attacker can generate a memory corruption via a FTS3 query of SQLite, in order to trigger a denial of service, and possibly to run code.
Impacted products: iOS by Apple, iPhone, Mac OS X, Debian, Fedora, FreeBSD, Android OS, Chrome, openSUSE Leap, Opera, RHEL, SQLite, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Ubuntu.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 3.
Creation date: 17/12/2018.
Identifiers: CVE-2018-20346, CVE-2018-20505, CVE-2018-20506, DLA-1613-1, DSA-4352-1, FEDORA-2018-5f91fbf4fd, FEDORA-2018-ccbe8b931c, FEDORA-2019-49f80a78bc, FreeBSD-EN-19:03.sqlite, HT209443, HT209446, Magellan, openSUSE-SU-2018:4056-1, openSUSE-SU-2018:4122-1, openSUSE-SU-2018:4142-1, openSUSE-SU-2018:4143-1, openSUSE-SU-2019:1159-1, openSUSE-SU-2019:1222-1, RHSA-2018:3803-01, SUSE-SU-2019:0913-1, SUSE-SU-2019:0973-1, SUSE-SU-2019:14003-1, Synology-SA-18:61, USN-4019-1, USN-4019-2, VIGILANCE-VUL-28027.

Description of the vulnerability

The FTS3/FTS4 extension of SQLite can be used to create tables with text indexes.

However, a series of special SQL queries using FTS3 triggers a memory corruption in the ext/fts3/fts3.c file. An access to a SQL session is thus needed for the attacker.

It can be noted that the Chrome browser supports SQL queries via WebSQL implemented with SQLite, so it is also vulnerable via a web page.

An attacker can therefore generate a memory corruption via a FTS3 query of SQLite, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2018-17481

Chrome: use after free via PDFium

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via PDFium of Chrome, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, Chrome, openSUSE Leap, Opera, SUSE Linux Enterprise Desktop, SLES.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 13/12/2018.
Identifiers: CERTFR-2018-AVI-599, CVE-2018-17481, DSA-4395-1, DSA-4395-2, openSUSE-SU-2018:4142-1, openSUSE-SU-2018:4143-1, VIGILANCE-VUL-28022.

Description of the vulnerability

An attacker can force the usage of a freed memory area via PDFium of Chrome, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-17479

Chrome: use after free via GPU

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via GPU of Chrome, in order to trigger a denial of service, and possibly to run code.
Impacted products: Chrome, openSUSE Leap, Opera, RHEL, SUSE Linux Enterprise Desktop, SLES.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 20/11/2018.
Identifiers: CERTFR-2018-AVI-562, CVE-2018-17479, openSUSE-SU-2018:3871-1, openSUSE-SU-2018:3872-1, RHSA-2018:3648-01, VIGILANCE-VUL-27840.

Description of the vulnerability

An attacker can force the usage of a freed memory area via GPU of Chrome, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability announce CVE-2018-17478

Chrome: out-of-bounds memory reading via V8

Synthesis of the vulnerability

An attacker can force a read at an invalid address via V8 of Chrome, in order to trigger a denial of service, or to obtain sensitive information.
Impacted products: Debian, Chrome, openSUSE Leap, Opera, RHEL, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: data reading, denial of service on client.
Provenance: document.
Creation date: 12/11/2018.
Identifiers: CERTFR-2018-AVI-540, CVE-2018-17478, DSA-4340-1, openSUSE-SU-2018:3805-1, openSUSE-SU-2018:3835-1, openSUSE-SU-2018:3837-1, RHSA-2018:3648-01, VIGILANCE-VUL-27757.

Description of the vulnerability

An attacker can force a read at an invalid address via V8 of Chrome, in order to trigger a denial of service, or to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2018-16083

WebRTC.org: out-of-bounds memory reading via FEC

Synthesis of the vulnerability

An attacker can force a read at an invalid address via FEC of WebRTC.org, in order to trigger a denial of service, or to obtain sensitive information.
Impacted products: Chrome, Opera, SLES, WebRTC.org.
Severity: 2/4.
Consequences: user access/rights, data reading, denial of service on client, no consequence.
Provenance: internet client.
Creation date: 21/09/2018.
Identifiers: 1606, CVE-2018-16083, openSUSE-SU-2018:2664-2, VIGILANCE-VUL-27291.

Description of the vulnerability

An attacker can force a read at an invalid address via FEC of WebRTC.org, in order to trigger a denial of service, or to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-16071

WebRTC.org: use after free via VP9

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via VP9 of WebRTC.org, in order to trigger a denial of service, and possibly to run code.
Impacted products: Chrome, Opera, SLES, WebRTC.org.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: intranet client.
Creation date: 21/09/2018.
Identifiers: 1601, CVE-2018-16071, openSUSE-SU-2018:2664-2, VIGILANCE-VUL-27290.

Description of the vulnerability

An attacker can force the usage of a freed memory area via VP9 of WebRTC.org, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability note 27254

Google Chrome: vulnerability

Synthesis of the vulnerability

A vulnerability of Google Chrome was announced.
Impacted products: Chrome, openSUSE Leap, Opera, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: unknown consequence, administrator access/rights, privileged access/rights, user access/rights, client access/rights, data reading, data creation/edition, data deletion, data flow, denial of service on server, denial of service on service, denial of service on client, disguisement.
Provenance: document.
Creation date: 18/09/2018.
Identifiers: CERTFR-2018-AVI-442, openSUSE-SU-2018:2728-2, openSUSE-SU-2018:2753-1, openSUSE-SU-2018:2754-1, openSUSE-SU-2018:2754-2, VIGILANCE-VUL-27254.

Description of the vulnerability

A vulnerability of Google Chrome was announced.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2018-17458 CVE-2018-17459

Google Chrome: two vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Google Chrome.
Impacted products: Debian, Chrome, openSUSE Leap, Opera, RHEL, SUSE Linux Enterprise Desktop, SLES.
Severity: 3/4.
Consequences: user access/rights, disguisement.
Provenance: document.
Number of vulnerabilities in this bulletin: 2.
Creation date: 12/09/2018.
Identifiers: CERTFR-2018-AVI-431, CVE-2018-17458, CVE-2018-17459, DSA-4297-1, openSUSE-SU-2018:2724-1, openSUSE-SU-2018:2728-1, openSUSE-SU-2018:2728-2, openSUSE-SU-2018:2754-2, RHSA-2018:2818-01, VIGILANCE-VUL-27222.

Description of the vulnerability

An attacker can use several vulnerabilities of Google Chrome.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2017-15406

V8: buffer overflow

Synthesis of the vulnerability

An attacker can generate a buffer overflow of V8, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, Fedora, Chrome, openSUSE Leap, Opera, RHEL, SUSE Linux Enterprise Desktop, SLES.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 29/08/2018.
Identifiers: CVE-2017-15406, DSA-4020-1, FEDORA-2018-faff5f661e, openSUSE-SU-2017:2902-1, openSUSE-SU-2017:3245-1, RHSA-2017:3082-01, VIGILANCE-VUL-27100.

Description of the vulnerability

An attacker can generate a buffer overflow of V8, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2018-6149

V8: memory corruption

Synthesis of the vulnerability

An attacker can generate a memory corruption of V8, in order to trigger a denial of service, and possibly to run code.
Impacted products: Debian, Fedora, Chrome, openSUSE Leap, Opera, RHEL, SUSE Linux Enterprise Desktop, SLES.
Severity: 3/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 13/06/2018.
Identifiers: CERTFR-2018-AVI-282, CVE-2018-6149, DSA-4237-1, FEDORA-2018-499f2dbc96, openSUSE-SU-2018:2054-1, openSUSE-SU-2018:2055-1, RHSA-2018:1933-01, VIGILANCE-VUL-26413.

Description of the vulnerability

An attacker can generate a memory corruption of V8, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Opera: