| Summary: | www-client/opera < 9.26 multiple vulnerabilities (CVE-2008-{1080,1081,1082}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Jeroen Roovers (RETIRED) <jer> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | fauli |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://secunia.com/advisories/29029/ | ||
| Whiteboard: | B3 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Jeroen Roovers (RETIRED)
2008-02-15 17:14:03 UTC
Quote from the URL: "We are also addressing a few security issues; details will be published in due time." File is already available (though not announced) on: ftp://get.opera.com/pub/opera/linux/926/final/ Haven't found a ChangeLog yet, but one could prepare an ebuild (In reply to comment #2) > File is already available (though not announced) on: > ftp://get.opera.com/pub/opera/linux/926/final/ Thanks for noticing. > Haven't found a ChangeLog yet, but one could prepare an ebuild Sure I could, put I won't put it in the tree until it's mirrored. www-client/opera-9.26 is in the tree. Arches please test and mark stable. Target keywords are: opera-9.26.ebuild:KEYWORDS="amd64 ppc sparc x86 ~x86-fbsd" x86 stable sparc stable details are out, no major issues. ppc stable amd64 stable This one is ready for GLSA vote. Fixed in release snapshot. http://www.opera.com/support/search/view/877/ http://www.opera.com/support/search/view/879/ http://www.opera.com/support/search/view/880/ I'd rather go for a YES here. Thx for the info rbu. GLSA request filed. Name: CVE-2008-1080 Opera before 9.26 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename into a file input. ====================================================== Name: CVE-2008-1081 Opera before 9.26 allows user-assisted remote attackers to execute arbitrary script via images that contain custom comments, which are treated as script when the user displays the image properties. ====================================================== Name: CVE-2008-1082 Opera before 9.26 allows remote attackers to "bypass sanitization filters" and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XML document, which are not properly handled during DOM presentation. GLSA 200803-09 |