Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Opera: Multiple vulnerabilities — GLSA 200502-17

Opera is vulnerable to several vulnerabilities which could result in information disclosure and facilitate execution of arbitrary code.

Affected packages

Package www-client/opera on all architectures
Affected versions < 7.54-r3
Unaffected versions >= 7.54-r3

Background

Opera is a multi-platform web browser.

Description

Opera contains several vulnerabilities:

  • fails to properly validate Content-Type and filename.
  • fails to properly validate date: URIs.
  • uses kfmclient exec as the Default Application to handle downloaded files when integrated with KDE.
  • fails to properly control frames.
  • uses Sun Java packages insecurely.
  • searches an insecure path for plugins.

Impact

An attacker could exploit these vulnerabilities to:

  • execute arbitrary code.
  • load a malicious frame in the context of another browser session.
  • leak information.

Workaround

There is no known workaround at this time.

Resolution

All Opera users should upgrade to the latest version: 

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-client/opera-7.54-r3"

References

Release date
February 14, 2005

Latest revision
December 30, 2007: 03

Severity
normal

Exploitable
remote

Bugzilla entries