Opera: Multiple vulnerabilities — GLSA 200803-09

Multiple vulnerabilities have been discovered in Opera, allowing for file disclosure, privilege escalation and Cross-Site scripting.

Affected Packages

www-client/opera on all architectures
Affected versions < 9.26
Unaffected versions >= 9.26

Background

Opera is a fast web browser that is available free of charge.

Description

Mozilla discovered that Opera does not handle input to file form fields properly, allowing scripts to manipulate the file path (CVE-2008-1080). Max Leonov found out that image comments might be treated as scripts, and run within the wrong security context (CVE-2008-1081). Arnaud reported that a wrong representation of DOM attribute values of imported XML documents allows them to bypass sanitization filters (CVE-2008-1082).

Impact

A remote attacker could entice a user to upload a file with a known path by entering text into a specially crafted form, to execute scripts outside intended security boundaries and conduct Cross-Site Scripting attacks.

Workaround

There is no known workaround at this time.

Resolution

All Opera users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-client/opera-9.26"

References

Release Date
March 04, 2008

Latest Revision
March 04, 2008: 01

Severity
normal

Exploitable
remote

Bugzilla entries