[PCWorks] Opera Multiple Vulnerabilities
- From: "Clint Hamilton-PCWorks Admin" <PCWorks@xxxxxxxxxxxxxxxxxxxxxxxx>
- To: "PCWorks@xxxxxxxxxxxxx" <pcworks@xxxxxxxxxxxxx>
- Date: Tue, 21 Oct 2008 15:48:38 -0500
TITLE:
Opera Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA32299
VERIFY ADVISORY:
http://secunia.com/advisories/32299/
CRITICAL:
Moderately critical
IMPACT:
Security Bypass, Cross Site Scripting, Exposure of sensitive
information
WHERE:
From remote
SOFTWARE:
Opera 5.x
http://secunia.com/advisories/product/82/
Opera 6.x
http://secunia.com/advisories/product/81/
Opera 7.x
http://secunia.com/advisories/product/761/
Opera 8.x
http://secunia.com/advisories/product/4932/
Opera 9.x
http://secunia.com/advisories/product/10615/
DESCRIPTION:
Some vulnerabilities have been reported in Opera, which can be
exploited by malicious people to conduct script insertion
attacks, to
bypass certain security restrictions, or to disclose
potentially
sensitive information.
1) Certain unspecified input is not properly sanitised by the
"History Search" functionality before being used. This can be
exploited to inject arbitrary HTML and script code, which is
executed
in a user's browser session when the malicious data is being
viewed,
leading to e.g. the disclosure of previously visited pages.
2) An error in the implementation of the "Fast Forward" feature
can
be exploited to execute arbitrary script code in the context of
a
restricted frame via a specially crafted JavaScript URL.
3) An error exists while blocking scripts during a news feed
preview.
This can be exploited to disclose the content of subscribed
news feeds
or to subscribe the user to an arbitrary news feed.
The vulnerabilities are reported in versions prior to 9.61.
SOLUTION:
Update to version 9.61.
http://www.opera.com/download/
ORIGINAL ADVISORY:
http://www.opera.com/support/search/view/903/
http://www.opera.com/support/search/view/904/
http://www.opera.com/support/search/view/905/
=========================
The list's FAQ's can be seen by sending an email to
PCWorks-request@xxxxxxxxxxxxx with FAQ in the subject line.
To unsubscribe, subscribe, set Digest or Vacation to on or off, go to
//www.freelists.org/list/pcworks . You can also send an email to
PCWorks-request@xxxxxxxxxxxxx with Unsubscribe in the subject line. Your
member list settings can be found at
//www.freelists.org/cgi-bin/lsg2.cgi/l=pcworks . Once logged in, you have
access to numerous other email options.
The list archives are located at //www.freelists.org/archives/pcworks/ .
All email posted to the list will be placed there in the event anyone needs to
look for previous posts.
-zxdjhu-
Other related posts:
