Extremely Severe Vulnerabilities Patched In Opera Browser
Opera released an update to its popular web browser on Tuesday that fixes vulnerabilities it described as “extremely severe”. The update fixes seven security bugs, some of which were previously known.
Version 9.63 of the browser addresses separate code injection risks stemming from flaws in HTML parsing and text input. A critical bug with similar arbitrary code injection risks involving the handling of long host names in files has also been patched. The latest version of the software also lances a cross-site scripting flaw, involving XSLT templates, as well as bugs in feed preview.
Fixed vulnerabilities in Opera 9.63 include:
Manipulating text input contents can allow execution of arbitrary code.
HTML parsing flaw can cause Opera to execute arbitrary code.
Long hostnames in file: URLs can cause execution of arbitrary code.
Script injection in feed preview can reveal contents of unrelated news feeds.
Built-in XSLT templates can allow cross-site scripting.
Fixed an issue that could reveal random data, as reported by Matthew of Hispasec Sistemas.
SVG images embedded using <img> tags can no longer execute Java or plugin content.
More details of these various fixes can be found on Opera Software’s website. The advisory covers Windows but other versions of the browser running on Mac and Linux also need updating against the similar cross-platform risks.
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.