GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2023:0298-1

Vulnerability from csaf_opensuse - Published: 2023-10-11 07:10 - Updated: 2023-10-11 07:10
Summary
Security update for opera
Severity
Important
Notes
Title of the patch: Security update for opera
Description of the patch: This update for opera fixes the following issues: - Update to 103.0.4928.16 * CHR-9416 Updating Chromium on desktop-stable-* branches * CHR-9433 Update Chromium on desktop-stable-117-4928 to 117.0.5938.89 * CHR-9449 Update Chromium on desktop-stable-117-4928 to 117.0.5938.132 * DNA-110337 Opera Intro extension custom versions * DNA-111454 Player animations visual adjustments * DNA-111618 Turn on #password-generator on all streams * DNA-111645 Turn on flag #player-service-react on developer stream * DNA-111708 Player home page is shown while music service is being loaded * DNA-111722 [Tab strip][Tab island] Add tab in tab island button appears after size of tabs is changed * DNA-111727 JsonPrefStore is created twice for Local State file * DNA-111838 Promote 103.0 to stable * DNA-111845 Turn on flag #player-service-react on all streams * DNA-111868 Translations for O103 * DNA-111874 OMenu and Context Menus has transparent few px border - The update to chromium 117.0.5938.89 fixes following issues: CVE-2023-5217, CVE-2023-5186, CVE-2023-5187 - Complete Opera 103 changelog at: https://blogs.opera.com/desktop/changelog-for-103/ - Update to 102.0.4880.78 * DNA-110952 Crash at base::subtle::RefCountedBase:: ReleaseImpl() const - Update to 102.0.4880.70 * DNA-105016 Do not open file selector when closing easy files dialog with 'close this popup' option * DNA-110437 Extensions font color in dark mode makes the text not visible * DNA-110443 Crash at EasyFilesView::ShowFileSelector * DNA-111231 Amazon Music logo update in sidebar Player * DNA-111280 Make import from Crypto Browser to Opera Browser easier * DNA-111355 [Sidebar] DevTools is not working correctly in with sidebar panel * DNA-111708 Player home page is shown while music service is being loaded * DNA-111162 Refresh Player home page * DNA-111164 Implement animation in Player home page - Update to 102.0.4880.56 * DNA-110785 Crash at static void base::allocator:: UnretainedDanglingRawPtrDetectedDumpWithoutCrashing (unsigned __int64) * DNA-110973 Crash after dragging tab from island to another screen * DNA-111199 Disable user_education tests from component_unittests * DNA-111369 Crash at views::View::DoRemoveChildView(views:: View*, bool, bool, views::View*) * DNA-111538 All new open windows don`t have a close button 'x' in the right upper corner. - Changes in 102.0.4880.51 * CHR-9416 Automatic tries of updating Chromium on desktop-stable-* branches * DNA-110101 [Linux] Maximize/restore button does not work properly * DNA-110669 duplicated hints on system buttons * DNA-110823 Uninstallation Survey Countries * DNA-110881 Scroll bar doesn't change color in dark mode * DNA-110930 Capture mouse events on the 1-pixel edge for DevTools * DNA-110935 ChatSonic colors are unreadable in Dark Mode * DNA-111034 Dynamic icon does not look good in edit-tile-modal * DNA-111035 Removal custom-image should restore dynamic icon * DNA-111177 [Start page] Letter in SD is black on light wallpaper * DNA-111488 Improve profile migration for desktop-stable-116-4880 - Update to 102.0.4880.46 * CHR-9416 Automatic tries of updating Chromium on desktop-stable-* branches * DNA-110216 [Sidebar] Straight lines instead of rounded corners * DNA-110539 [LIN] Crash at content::WebContentsImpl:: GetLastCommittedURL() * DNA-110631 AB test mechanism for Speed Dial * DNA-110656 [TabStrip] Memory leak for tab group * DNA-111322 Only show splash screen on major version update * DNA-111417 Crash at opera::component_based:: TabAnimationController::StartAnimatedLayout(opera:: component_based::TabAnimationController::AnimationInfo, base::OnceCallback) * DNA-111420 Update continue on link for euro rtv agd * DNA-111440 Crash at opera::component_based:: ComponentTabBar::GetActiveTab()
Patchnames: openSUSE-2023-298
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2023-5186
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2023-5187
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2023-5186
Threats
Impact important
CVE-2023-5217
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2023-5186
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for opera",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for opera fixes the following issues:\n\n- Update to 103.0.4928.16\n  * CHR-9416 Updating Chromium on desktop-stable-* branches\n  * CHR-9433 Update Chromium on desktop-stable-117-4928 to\n    117.0.5938.89\n  * CHR-9449 Update Chromium on desktop-stable-117-4928 to\n    117.0.5938.132\n  * DNA-110337 Opera Intro extension custom versions\n  * DNA-111454 Player animations visual adjustments\n  * DNA-111618 Turn on #password-generator on all streams\n  * DNA-111645 Turn on flag #player-service-react on\n    developer stream\n  * DNA-111708 Player home page is shown while music service is\n    being loaded\n  * DNA-111722 [Tab strip][Tab island] Add tab in tab island\n    button appears after size of tabs is changed\n  * DNA-111727 JsonPrefStore is created twice for Local State file\n  * DNA-111838 Promote 103.0 to stable\n  * DNA-111845 Turn on flag #player-service-react on all streams\n  * DNA-111868 Translations for O103\n  * DNA-111874 OMenu and Context Menus has transparent few\n    px border\n- The update to chromium 117.0.5938.89 fixes following issues:\n  CVE-2023-5217, CVE-2023-5186, CVE-2023-5187\n- Complete Opera 103 changelog at:\n  https://blogs.opera.com/desktop/changelog-for-103/\n\n- Update to 102.0.4880.78\n  * DNA-110952 Crash at base::subtle::RefCountedBase::\n    ReleaseImpl() const\n\n- Update to 102.0.4880.70\n  * DNA-105016 Do not open file selector when closing easy files\n    dialog with \u0027close this popup\u0027 option\n  * DNA-110437 Extensions font color in dark mode makes the text\n    not visible\n  * DNA-110443 Crash at EasyFilesView::ShowFileSelector\n  * DNA-111231 Amazon Music logo update in sidebar Player\n  * DNA-111280 Make import from Crypto Browser to Opera Browser\n    easier\n  * DNA-111355 [Sidebar] DevTools is not working correctly in\n    with sidebar panel\n  * DNA-111708 Player home page is shown while music service is\n    being loaded\n  * DNA-111162 Refresh Player home page\n  * DNA-111164 Implement animation in Player home page\n\n- Update to 102.0.4880.56\n  * DNA-110785 Crash at static void base::allocator::\n    UnretainedDanglingRawPtrDetectedDumpWithoutCrashing\n    (unsigned __int64)\n  * DNA-110973 Crash after dragging tab from island to another\n    screen\n  * DNA-111199 Disable user_education tests from\n    component_unittests\n  * DNA-111369 Crash at views::View::DoRemoveChildView(views::\n    View*, bool, bool, views::View*)\n  * DNA-111538 All new open windows don`t have a close button \u0027x\u0027\n    in the right upper corner.\n- Changes in 102.0.4880.51\n  * CHR-9416 Automatic tries of updating Chromium on\n    desktop-stable-* branches\n  * DNA-110101 [Linux] Maximize/restore button does not work\n    properly\n  * DNA-110669 duplicated hints on system buttons\n  * DNA-110823 Uninstallation Survey Countries\n  * DNA-110881 Scroll bar doesn\u0027t change color in dark mode\n  * DNA-110930 Capture mouse events on the 1-pixel edge for\n    DevTools\n  * DNA-110935 ChatSonic colors are unreadable in Dark Mode\n  * DNA-111034 Dynamic icon does not look good in edit-tile-modal\n  * DNA-111035 Removal custom-image should restore dynamic icon\n  * DNA-111177 [Start page] Letter in SD is black on light\n    wallpaper\n  * DNA-111488 Improve profile migration for\n    desktop-stable-116-4880\n\n- Update to 102.0.4880.46\n  * CHR-9416 Automatic tries of updating Chromium on\n    desktop-stable-* branches\n  * DNA-110216 [Sidebar] Straight lines instead of rounded corners\n  * DNA-110539 [LIN] Crash at content::WebContentsImpl::\n    GetLastCommittedURL()\n  * DNA-110631 AB test mechanism for Speed Dial\n  * DNA-110656 [TabStrip] Memory leak for tab group\n  * DNA-111322 Only show splash screen on major version update\n  * DNA-111417 Crash at opera::component_based::\n    TabAnimationController::StartAnimatedLayout(opera::\n    component_based::TabAnimationController::AnimationInfo,\n    base::OnceCallback)\n  * DNA-111420 Update continue on link for euro rtv agd\n  * DNA-111440 Crash at opera::component_based::\n    ComponentTabBar::GetActiveTab()\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2023-298",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2023_0298-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2023:0298-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/V5KRGLOBRAIYNFCNZH4YM2ETGNMPQEKZ/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2023:0298-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/V5KRGLOBRAIYNFCNZH4YM2ETGNMPQEKZ/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-5186 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-5186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-5187 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-5187/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-5217 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-5217/"
      }
    ],
    "title": "Security update for opera",
    "tracking": {
      "current_release_date": "2023-10-11T07:10:39Z",
      "generator": {
        "date": "2023-10-11T07:10:39Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2023:0298-1",
      "initial_release_date": "2023-10-11T07:10:39Z",
      "revision_history": [
        {
          "date": "2023-10-11T07:10:39Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "opera-103.0.4928.16-lp154.2.53.1.x86_64",
                "product": {
                  "name": "opera-103.0.4928.16-lp154.2.53.1.x86_64",
                  "product_id": "opera-103.0.4928.16-lp154.2.53.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4 NonFree",
                "product": {
                  "name": "openSUSE Leap 15.4 NonFree",
                  "product_id": "openSUSE Leap 15.4 NonFree",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opera-103.0.4928.16-lp154.2.53.1.x86_64 as component of openSUSE Leap 15.4 NonFree",
          "product_id": "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
        },
        "product_reference": "opera-103.0.4928.16-lp154.2.53.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4 NonFree"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-5186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-5186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-5186",
          "url": "https://www.suse.com/security/cve/CVE-2023-5186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215776 for CVE-2023-5186",
          "url": "https://bugzilla.suse.com/1215776"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-10-11T07:10:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-5186"
    },
    {
      "cve": "CVE-2023-5187",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-5187"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-5187",
          "url": "https://www.suse.com/security/cve/CVE-2023-5187"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215776 for CVE-2023-5187",
          "url": "https://bugzilla.suse.com/1215776"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-10-11T07:10:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-5187"
    },
    {
      "cve": "CVE-2023-5217",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-5217"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-5217",
          "url": "https://www.suse.com/security/cve/CVE-2023-5217"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215776 for CVE-2023-5217",
          "url": "https://bugzilla.suse.com/1215776"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215778 for CVE-2023-5217",
          "url": "https://bugzilla.suse.com/1215778"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1215814 for CVE-2023-5217",
          "url": "https://bugzilla.suse.com/1215814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1217559 for CVE-2023-5217",
          "url": "https://bugzilla.suse.com/1217559"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-103.0.4928.16-lp154.2.53.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-10-11T07:10:39Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-5217"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.