Opera Software has released an update for their Opera web browser. Version 10.10 contains fixes to three vulnerabilities, one categorized as "extremely severe", one "highly severe" and one "moderately severe".
Extremely severe:
Passing very long strings through the string to number conversion using JavaScript in Opera may result in heap buffer overflows. This also affects the dtoa routine, and was reported in CVE-2009-0689. In most cases Opera will just freeze or terminate, but in some cases this could lead to a crash which could be used to execute code. To inject code, additional techniques will have to be employed.
Highly severe:
Scripting error messages are normally available only to the page that caused the error. In some cases, the error messages could be passed to other sites as the contents of unrelated variables, and may contain sensitive information. If those sites write the content into the page markup, this could allow cross-site scripting, using code provided by the attacking site. This issue only affects installations that have enabled stacktraces for exceptions, these are disabled by default.
Details of "moderately severe" vulnerability was not released.
Opera users are strongly recommended to update to 10.10 version. New version can be downloaded here.
Changelog of Windows version
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment