Summary: | <www-client/opera-11.62.1347-r1: multiple vulnerabilities (CVE-2012-{1924,1925,1926,1927,1928,1930,1931}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Jeroen Roovers (RETIRED) <jer> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | normal | ||
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://www.opera.com/docs/changelogs/unix/1162/ | ||
Whiteboard: | B2 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Jeroen Roovers (RETIRED)
2012-03-27 12:16:49 UTC
= CORRECTION = Arch teams, please test and mark stable: =www-client/opera-11.62.1347-r1 Target KEYWORDS="amd64 x86" amd64: pass amd64 stable CVE-2012-1931 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1931): Opera before 11.62 on UNIX, when used in conjunction with an unspecified printing application, allows local users to overwrite arbitrary files via a symlink attack on a temporary file during printing. CVE-2012-1930 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1930): Opera before 11.62 on UNIX uses world-readable permissions for temporary files during printing, which allows local users to obtain sensitive information by reading these files. CVE-2012-1928 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1928): Opera before 11.62 allows remote attackers to spoof the address field by triggering a page reload followed by a redirect to a different domain. CVE-2012-1927 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1927): Opera before 11.62 allows remote attackers to spoof the address field by triggering the launch of a dialog window associated with a different domain. CVE-2012-1926 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1926): Opera before 11.62 allows remote attackers to bypass the Same Origin Policy via the (1) history.pushState and (2) history.replaceState functions in conjunction with cross-domain frames, leading to unintended read access to history.state information. CVE-2012-1925 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1925): Opera before 11.62 does not ensure that a dialog window is placed on top of content windows, which makes it easier for user-assisted remote attackers to trick users into downloading and executing arbitrary files via a download dialog located under other windows. CVE-2012-1924 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1924): Opera before 11.62 allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog. X86 stable, thanks! Closing! Ooops, its security, so reopening!! sorry for the bugspam! Thanks, everyone. GLSA request is ready for review. This issue was resolved and addressed in GLSA 201206-03 at http://security.gentoo.org/glsa/glsa-201206-03.xml by GLSA coordinator Sean Amoss (ackle). |