Two vulnerabilities have been identified in the Opera browser, which potentially can be exploited by malicious people to compromise a user's system.

1) A boundary error in the zip processing when handling skin files can be exploited to cause a buffer overflow. This may allow execution of arbitrary code on a user's system, if the user is tricked into visiting a malicious website.

This issue affects both Linux and Windows systems.

2) An input validation error when handling skin files can be exploited to place a malicious file in an arbitrary directory on a user's system. This can be done via a directory traversal attack where the URL encoded representation of backslashes is used ("%5C").

Example:
http://[malicious_server]/..%5c..%5c..%5c..%5cskin.zip

Successful exploitation requires that the user is tricked into visiting a malicious website. Only Windows platforms are affected by this issue.

Both vulnerabilities affect version 7.22 and prior.

Solution
Update to version 7.23.
Further details available to Secunia VIM customers

Provided and/or discovered by
Jouko Pynnönen

Original Advisory
Changelog for Opera 7.23 for Linux:
http://www.opera.com/linux/changelogs/723/

Changelog for Opera 7.23 for Windows:
http://www.opera.com/windows/changelogs/723/

Deep Links
Links available to Secunia VIM customers