Secunia

Stefan Esser has discovered a vulnerability in Opera, which can be exploited by malicious people to conduct cross-site scripting attacks.

The vulnerability exist because pages that do not specify a charset inherit the charset of the parent page. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of certain sites that are included e.g. via iframes in a malicious page that uses UTF-7 as charset.

Successful exploitation requires that the user is tricked into visiting a malicious web site.

The vulnerability is confirmed in version 9.10. Other versions may also be affected.

Solution
Update to version 9.20.

Provided and/or discovered by
Stefan Esser

Changelog
Further details available in Customer Area

Original Advisory
Hardened-PHP Project:
http://www.hardened-php.net/advisory_032007.142.html

Opera:
http://www.opera.com/support/search/view/855/

Deep Links
Links available in Customer Area