CVE-2007-0127

Opera < 9.10 - Remote Code Execution via SVG Transform Matrix Object Type Confusion

Title source: llm
STIX 2.1

Description

The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.

References (10)

Core 10
Core References
Various Sources vendor-advisory x_refsource_suse
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0009.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/31575
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1017473
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23613
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0060
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23739
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200701-08.xml
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23771
Patch, Vendor Advisory third-party-advisory x_refsource_idefense
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458

Scores

EPSS 0.1008
EPSS Percentile 93.2%

Details

CWE
CWE-94
Status published
Products (27)
opera/opera_browser 1.00
opera/opera_browser 2.00
opera/opera_browser 2.10 (4 CPE variants)
opera/opera_browser 2.12
opera/opera_browser 3.00 (2 CPE variants)
opera/opera_browser 3.10
opera/opera_browser 3.21
opera/opera_browser 3.50
opera/opera_browser 3.51
opera/opera_browser 3.60
... and 17 more
Published Jan 09, 2007
Tracked Since Feb 18, 2026