Description
The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.
References
- 31575 vdb-entry
- http://www.opera.com/support/search/supsearch.dml?index=851
- 1017473 vdb-entry
- 23613 third-party-advisory
- ADV-2007-0060 vdb-entry
- 23739 third-party-advisory
- GLSA-200701-08 vendor-advisory
- 23771 third-party-advisory
- SUSE-SA:2007:009 vendor-advisory
- 20070105 Opera Software Opera Web Browser createSVGTransformFromMatrix Object Typecasting Vulnerability third-party-advisory