Arch Linux Security Advisory ASA-202112-2
=========================================
Severity: High
Date : 2021-12-03
CVE-ID : CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008
CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012
CVE-2021-38013 CVE-2021-38014 CVE-2021-38015 CVE-2021-38016
CVE-2021-38017 CVE-2021-38018 CVE-2021-38019 CVE-2021-38020
CVE-2021-38021 CVE-2021-38022
Package : opera
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2563
Summary
=======
The package opera before version 82.0.4227.23-1 is vulnerable to
multiple issues including arbitrary code execution, access restriction
bypass, content spoofing, information disclosure, same-origin policy
bypass, sandbox escape and denial of service.
Resolution
==========
Upgrade to 82.0.4227.23-1.
# pacman -Syu "opera>=82.0.4227.23-1"
The problems have been fixed upstream in version 82.0.4227.23.
Workaround
==========
None.
Description
===========
- CVE-2021-38005 (arbitrary code execution)
A use after free security issue has been found in the loader component
of the Chromium browser engine before version 96.0.4664.45.
- CVE-2021-38006 (arbitrary code execution)
A use after free security issue has been found in the storage
foundation component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38007 (arbitrary code execution)
A type confusion security issue has been found in the V8 component of
the Chromium browser engine before version 96.0.4664.45.
- CVE-2021-38008 (arbitrary code execution)
A use after free security issue has been found in the media component
of the Chromium browser engine before version 96.0.4664.45.
- CVE-2021-38009 (arbitrary code execution)
An inappropriate implementation security issue has been found in the
cache component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38010 (arbitrary code execution)
An inappropriate implementation security issue has been found in the
service workers component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38011 (arbitrary code execution)
A use after free security issue has been found in the storage
foundation component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38012 (arbitrary code execution)
A type confusion security issue has been found in the V8 component of
the Chromium browser engine before version 96.0.4664.45.
- CVE-2021-38013 (arbitrary code execution)
A heap buffer overflow security issue has been found in the fingerprint
recognition component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38014 (arbitrary code execution)
An out of bounds write security issue has been found in the Swiftshader
component of the Chromium browser engine before version 96.0.4664.45.
- CVE-2021-38015 (arbitrary code execution)
An inappropriate implementation security issue has been found in the
input component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38016 (access restriction bypass)
An insufficient policy enforcement security issue has been found in the
background fetch component of the Chromium browser engine before
version 96.0.4664.45.
- CVE-2021-38017 (sandbox escape)
An insufficient policy enforcement security issue has been found in the
iframe sandbox component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38018 (content spoofing)
An inappropriate implementation security issue has been found in the
navigation component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38019 (same-origin policy bypass)
An insufficient policy enforcement security issue has been found in the
CORS component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38020 (information disclosure)
An insufficient policy enforcement security issue has been found in the
contacts picker component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38021 (information disclosure)
An inappropriate implementation security issue has been found in the
referrer component of the Chromium browser engine before version
96.0.4664.45.
- CVE-2021-38022 (denial of service)
An inappropriate implementation security issue has been found in the
WebAuthentication component of the Chromium browser engine before
version 96.0.4664.45.
Impact
======
A remote attacker could execute arbitrary code, spoof content, bypass
security restrictions or crash the browser through crafted web content.
References
==========
https://blogs.opera.com/desktop/changelog-for-81/https://blogs.opera.com/desktop/changelog-for-82/https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-des…https://crbug.com/1241091https://crbug.com/1240593https://crbug.com/1254189https://crbug.com/1263620https://crbug.com/1260649https://crbug.com/1264477https://crbug.com/1268274https://crbug.com/1262791https://crbug.com/1242392https://crbug.com/1248567https://crbug.com/957553https://crbug.com/1244289https://crbug.com/1256822https://crbug.com/1197889https://crbug.com/1251179https://crbug.com/1259694https://crbug.com/1233375https://crbug.com/1248862https://security.archlinux.org/CVE-2021-38005https://security.archlinux.org/CVE-2021-38006https://security.archlinux.org/CVE-2021-38007https://security.archlinux.org/CVE-2021-38008https://security.archlinux.org/CVE-2021-38009https://security.archlinux.org/CVE-2021-38010https://security.archlinux.org/CVE-2021-38011https://security.archlinux.org/CVE-2021-38012https://security.archlinux.org/CVE-2021-38013https://security.archlinux.org/CVE-2021-38014https://security.archlinux.org/CVE-2021-38015https://security.archlinux.org/CVE-2021-38016https://security.archlinux.org/CVE-2021-38017https://security.archlinux.org/CVE-2021-38018https://security.archlinux.org/CVE-2021-38019https://security.archlinux.org/CVE-2021-38020https://security.archlinux.org/CVE-2021-38021https://security.archlinux.org/CVE-2021-38022