<?xml version="1.0"?>
<?xml-stylesheet href="../fma_report_en.xslt" type="text/xsl" ?>

<advisory xml:space="preserve">
	<meta>
		<description>Opera Browser 11.61 and 12.00 RC SVG Denial of Service</description>
		<keywords>fuzzing, security, blackbox, tests, Opera, DoS, SVG</keywords>
	</meta>

	<title>Opera Browser SVG Denial of Service</title>
	<id>FMA-2012-001</id>
	
	<refs>
		<ref>
			<name>DSK</name>
			<id>DSK-359771</id>
		</ref>	
	</refs>
	
	<application>
		<name>Opera</name>
		<version>11.61 (1250); 12.00 RC</version>
		<url>http://www.opera.com</url>
		<files>
			<file>
				<name>Opera.dll</name>
				<version>12.0.1454.0</version>
				<md5>81311d2b76a32e913a721ba9eab93b48</md5>
			</file>
		</files>		
		<verified>
			<os>
				<name>Windows XP SP3 Home Edition</name>
			</os>
			<os>
				<name>Windows 7 SP1 Home Premium</name>
			</os>
		</verified>
	</application>
	
	<discovery>
		<found>2012.01.01</found>
		<vendor_notified>2012.03.21</vendor_notified>
		<published>2012.06.16</published>
	</discovery>
	
	<vulnerabilities>
		<vulnerability>
			<name>Opera Browser null pointer dereference.</name>
			<type>DoS</type>
			<description>Calling any function on certain SVG object raises access violation exception because of null pointer dereference.</description>
			<exception>Access violation exception.</exception>
<disasm>63DE3858  |.  8B7B 70       MOV EDI,DWORD PTR DS:[EBX+70]
63DE385B  |.  81C7 A4010000 ADD EDI,1A4
63DE3861  |.  E8 D30D0400   CALL 63E24639                ; [Opera_dll.63E24639
(...)
63E24667  |.  56            PUSH ESI                     ; /Arg2
63E24668  |.  FF77 0C       PUSH DWORD PTR DS:[EDI+0C]   ; |Arg1  [FuzzMyApp.com] access violation
63E2466B  |.  8BC7          MOV EAX,EDI                  ; |
63E2466D  |.  E8 2EB5F9FF   CALL 63DBFBA0                ; \Opera_dll.63DBFBA0</disasm>
			<images>
				<image>
					<thumbnail>
						<src>image01s.png</src>
						<width>100</width>
						<height>66</height>
					</thumbnail>
					<src>image01.png</src>
					<alt>Access violation when reading</alt>
					<text>Access violation when reading</text>
				</image>
			</images>
		</vulnerability>	
	</vulnerabilities>
</advisory>