Summary: | www-client/opera < 9.62: Multiple vulnerabilities (RCE through history XSS) (CVE-2008-{4794,4795}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Jeroen Roovers (RETIRED) <jer> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | ||
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://www.opera.com/docs/changelogs/linux/962/ | ||
Whiteboard: | A2 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Jeroen Roovers (RETIRED)
2008-10-30 17:11:14 UTC
The ebuild is in the tree. * Fixed an issue where History Search could be used to execute arbitrary code, as discovered by Aviv Raff; see our advisory[1] * The links panel no longer allows cross-site scripting; see our advisory[2] [1] http://www.opera.com/support/search/view/906/ "Extremely Severe" [2] http://www.opera.com/support/search/view/907/ "Highly Severe" Thanks, setting whiteboard and severity, CC'ing arches... Arches, please test and stabilize: =www-client/opera-9.62 Target keywords: "amd64 ppc x86" ppc stable We should note in our GLSA, that users may remain vulnerable even after upgrading, once the config has been manipulated by a malicious script (i.e. mailto handler for example). We could create a script that checks for manipulation and warns the user...? Comment written with opera 9.62 x86. Seems to work just like older version. (In reply to comment #5) > We could create a script that checks for manipulation and warns the user...? I don't think we want to go so far, people need to do forensics on their systems if someone exploited a security issue anyway. There are tons of cases where we cannot determine an exploit scenario via a script. # ChangeLog for www-client/opera # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2 # $Header: /var/cvsroot/gentoo-x86/www-client/opera/ChangeLog,v 1.303 2008/10/30 21:17:39 keytoaster Exp $ 30 Oct 2008; Tobias Heinlein <keytoaster@gentoo.org> opera-9.62.ebuild: amd64 stable, security bug #244980 (In reply to comment #8) > # ChangeLog for www-client/opera > # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2 > # $Header: /var/cvsroot/gentoo-x86/www-client/opera/ChangeLog,v 1.303 > 2008/10/30 21:17:39 keytoaster Exp $ > > 30 Oct 2008; Tobias Heinlein <keytoaster@gentoo.org> opera-9.62.ebuild: > amd64 stable, security bug #244980 > Oops, forgot to report on the bug. Thanks! CVE-2008-4794 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4794): Opera before 9.62 allows remote attackers to execute arbitrary commands via the History Search results page, a different vulnerability than CVE-2008-4696. CVE-2008-4795 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4795): The links panel in Opera before 9.62 processes Javascript within the context of the "outermost page" of a frame, which allows remote attackers to inject arbitrary web script or HTML via cross-site scripting (XSS) attacks. @x86: ping pong, all arches done. GLSA 200811-01, thanks everyone. |