Opera: Multiple vulnerabilities

2008-03-04T00:00:00
ID GLSA-200803-09
Type gentoo
Reporter Gentoo Foundation
Modified 2008-03-04T00:00:00

Description

Background

Opera is a fast web browser that is available free of charge.

Description

Mozilla discovered that Opera does not handle input to file form fields properly, allowing scripts to manipulate the file path (CVE-2008-1080). Max Leonov found out that image comments might be treated as scripts, and run within the wrong security context (CVE-2008-1081). Arnaud reported that a wrong representation of DOM attribute values of imported XML documents allows them to bypass sanitization filters (CVE-2008-1082).

Impact

A remote attacker could entice a user to upload a file with a known path by entering text into a specially crafted form, to execute scripts outside intended security boundaries and conduct Cross-Site Scripting attacks.

Workaround

There is no known workaround at this time.

Resolution

All Opera users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-client/opera-9.26"