CVE-2007-0127: Code Injection
Published Jan 9, 2007
·Updated
The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attackers to execute arbitrary code via JavaScript code that uses an invalid object in this request that causes a controlled pointer to be referenced during the virtual function call.
Affected Software
94 affected components
opera Opera Browser=4.01
opera Opera Browser=7.01
opera Opera Browser=7.23
opera Opera Browser=2.10
opera Opera Browser=2.10-beta2
opera Opera Browser=7.03
opera Opera Browser=7.53
opera Opera Browser=4.00-beta6
opera Opera Browser=8.50
opera Opera Browser=4.00-beta3
opera Opera Browser=5.0-beta2
opera Opera Browser=5.11
opera Opera Browser=3.51
opera Opera Browser=6.1
opera Opera Browser=7.20
opera Opera Browser=6.02
opera Opera Browser=2.00
opera Opera Browser=5.02
opera Opera Browser=1.00
opera Opera Browser<=9.02
opera Opera Browser=5.10
opera Opera Browser=8.53
opera Opera Browser=7.11-beta2
opera Opera Browser=8.0
opera Opera Browser=4.00
opera Opera Browser=2.10-beta1
opera Opera Browser=6.04
opera Opera Browser=8.54
opera Opera Browser=6.11
opera Opera Browser=5.0-beta4
opera Opera Browser=6.05
opera Opera Browser=8.02
opera Opera Browser=7.50-beta1
opera Opera Browser=3.10
opera Opera Browser=5.12
opera Opera Browser=4.02
opera Opera Browser=7.10
opera Opera Browser=9.0-beta1
opera Opera Browser=6.0-tp3
opera Opera Browser=3.50
opera Opera Browser=6.0-tp1
opera Opera Browser=8.0-beta3
opera Opera Browser=3.61
opera Opera Browser=5.0-beta8
opera Opera Browser=7.0-beta1_v2
opera Opera Browser=3.00-beta
opera Opera Browser=8.51
opera Opera Browser=5.0-beta5
opera Opera Browser=4.00-beta5
opera Opera Browser=7.50
opera Opera Browser=7.02
opera Opera Browser=7.21
opera Opera Browser=6.0-tp2
opera Opera Browser=5.0-beta7
opera Opera Browser=7.20-beta7
opera Opera Browser=7.54-update1
opera Opera Browser=7.60
opera Opera Browser=7.11
opera Opera Browser=7.0-beta2
opera Opera Browser=4.00-beta2
opera Opera Browser=7.54
opera Opera Browser=9.0-beta2
opera Opera Browser=6.03
opera Opera Browser=3.00
opera Opera Browser=7.0-beta1
opera Opera Browser=6.0-beta1
opera Opera Browser=3.62
opera Opera Browser=2.10-beta3
opera Opera Browser=9.01
opera Opera Browser=9.0
opera Opera Browser=3.60
opera Opera Browser=5.0
opera Opera Browser=7.51
opera Opera Browser=8.0-beta2
opera Opera Browser=3.62-beta
opera Opera Browser=6.12
opera Opera Browser=6.0-beta2
opera Opera Browser=4.00-beta4
opera Opera Browser=5.0-beta3
opera Opera Browser=6.01
opera Opera Browser=8.52
opera Opera Browser=6.06
opera Opera Browser=7.52
opera Opera Browser=7.54-update2
opera Opera Browser=3.21
opera Opera Browser=5.0-beta6
opera Opera Browser=8.01
opera Opera Browser=6.1-beta1
opera Opera Browser=2.12
opera Opera Browser=8.0-beta1
opera Opera Browser=6.0
opera Opera Browser=7.22
opera Opera Browser=7.10-beta1
opera Opera Browser=7.0
Remediation
Patch Available
Event History
Jan 9, 2007
CVE Published
02:28 AM
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-0127?
CVE-2007-0127 is categorized as a high-severity vulnerability that allows remote code execution.
2
How do I fix CVE-2007-0127?
To mitigate CVE-2007-0127, upgrade to Opera version 9.10 or higher.
3
What software is affected by CVE-2007-0127?
CVE-2007-0127 affects multiple versions of the Opera browser prior to 9.10.
4
What type of vulnerability is CVE-2007-0127?
CVE-2007-0127 is a vulnerability in the JavaScript SVG support in the Opera browser.
5
Can CVE-2007-0127 be exploited remotely?
Yes, CVE-2007-0127 can be exploited remotely using crafted JavaScript code.