Opera Web Browser Security Bypass and Unspecified Vulnerabilities

Bugtraq ID:	37089
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Nov 23 2009 12:00AM
Updated:	Nov 23 2009 03:45PM
Credit:	Chris Evans of the Google Security Team and the vendor
Vulnerable:	Opera Software Opera Web Browser 10.01 Opera Software Opera Web Browser 10
Not Vulnerable:	Opera Software Opera Web Browser 10.10

Opera Web Browser Security Bypass and Unspecified Vulnerabilities

Opera Web Browser is prone to a security-bypass vulnerability and an unspecified vulnerability.

An attacker may leverage the security-bypass issue to pass on data from one site to another through unrelated content variables and execute arbitrary script code. This may allow the attacker to launch cross-site scripting attacks or potentially obtain sensitive information. The second issue has an unknown, but moderate, impact.

Versions prior to Opera 10.10 are affected.

Opera Web Browser Security Bypass and Unspecified Vulnerabilities

Attackers can exploit the issues by enticing an unsuspecting user to visit a crafted webpage.

Opera Web Browser Security Bypass and Unspecified Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Opera Web Browser Security Bypass and Unspecified Vulnerabilities

References:

• Opera 10.10 (Opera Unite) for Windows changelog (Opera Software)
  
• Opera Homepage (Opera Software)
  
• Error messages can leak onto unrelated sites (Opera Software)