High severity · published Sep 27, 2008
CVE-2008-4197
Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which…
8.8
CVSS
6.3%
EPSS
No
On KEV
Description
Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which might allow user-assisted remote attackers to execute arbitrary code or conduct other attacks via vectors related to activation of a shortcut.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Opera Browser · Opera
before 9.52 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4197
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4197
Issue Tracking
http://bugs.gentoo.org/show_bug.cgi?id=235298
Broken Link
http://secunia.com/advisories/31549
Broken Link
http://secunia.com/advisories/32538
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200811-01.xml
Mailing List
http://www.openwall.com/lists/oss-security/2008/09/19/2
Mailing List
http://www.openwall.com/lists/oss-security/2008/09/24/4
More from Opera Browser
7.8
CVE-2018-18913
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the…
7.5
CVE-2009-3046
Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain…
6.1
CVE-2016-4075
Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank URL
6.1
CVE-2016-6908
Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, due to mishandling of several unicode…
5.3
CVE-2016-7153
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain…