Opera: Multiple vulnerabilities

Security Team Contact Address

Updated February 14, 2005

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
www-client/opera	< 7.54-r3	>= 7.54-r3	All supported architectures

Related bugreports: #73871, #74076, #74321, #81747

Opera is vulnerable to several vulnerabilities which could result in information disclosure and facilitate execution of arbitrary code.

2. Impact Information

Opera is a multi-platform web browser.

Opera contains several vulnerabilities:

fails to properly validate Content-Type and filename.
fails to properly validate date: URIs.
uses kfmclient exec as the Default Application to handle downloaded files when integrated with KDE.
fails to properly control frames.
uses Sun Java packages insecurely.
searches an insecure path for plugins.

An attacker could exploit these vulnerabilities to:

3. Resolution Information

There is no known workaround at this time.

All Opera users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/opera-7.54-r3"

4. References