Two security issue and multiple vulnerabilities have been reported in Opera, which can be exploited by malicious, local users to disclose potentially sensitive information and manipulate certain data and by malicious people to conduct spoofing attacks, bypass certain security restrictions, and potentially compromise a user's system.
1) An error when displaying the download dialog box within a small window can be exploited to download and execute a file by tricking a user into entering a specific keyboard sequence.
2) An error when displaying the download dialog box can be exploited to overlay the box with other content subsequently tricking a user into downloading and executing a file.
3) An error when handling history.state of sites implementing history.pushState and history.replaceState can be exploited to bypass the cross-domain policy restriction and disclose certain information to other sites.
4) An error when displaying certain dialogs can be exploited to display arbitrary content while showing the URL of a trusted web site in the address bar.
5) An error when handling redirects to a slowly responding, trusted site can be exploited to display arbitrary content while showing the URL of a trusted web site in the address bar.
6) An error related to the creation of a temporary file when printing a document using certain printing frameworks can be exploited to corrupt files via symlink attacks.
7) An error due to incorrect permissions of a temporary file when printing can be exploited to disclose the content of the printed documents.
Note: The vulnerabilities #6 and #7 only affect Opera for UNIX.
8) An error when displaying certain styles can be exploited to overlay the address bar.
Note: This vulnerability only affects Opera for Mac.
The vulnerabilities are reported in versions prior to 11.62.
Solution: Update to version 11.62.
Provided and/or discovered by: 1, 2, 5) The vendor credits Jordi Chancel.
3, 4, 8) Reported by the vendor.
6, 7) The vendor credits Christof Meerwald.
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to firstname.lastname@example.org
Subject: Opera Multiple Vulnerabilities
No posts yet
You must be logged in to post a comment.
Secunia Customer Login
Not a customer already?
Learn more about how our market leading Vulnerability Management solutions can help you manage risk and ensure compliance.