=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2008/VULN450
_____________________________________________________________________

DATE                      : 22/10/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Opera versions prior to
                                                      9.61.

======================================================================
http://www.opera.com/support/search/view/903/
http://www.opera.com/support/search/view/904/
http://www.opera.com/support/search/view/905/
______________________________________________________________________

Advisory: History Search can reveal browsing history



Severity

Extremely Severe


Platforms

All desktop versions


Problem Description

Certain constructs are not escaped correctly by Opera's History Search
results. These can be used to inject scripts into the page, which can
then be used to look through the user's browsing history, including the
contents of the pages they have visited. These may contain sensitive
information.


Opera's Response

Opera Software has released Opera 9.61, where this issue has been fixed.


Credits

Thanks to Roberto Suggi Liverani of Security-Assessment.com for
reporting this issue to Opera Software.

______________________________________________________________________

Advisory: Fast Forward can allow cross-site scripting


Severity

Highly Severe


Platforms

All desktop versions


Problem Description

If a link that uses a JavaScript URL triggers Opera's Fast Forward
feature, when the user activates Fast Forward, the script should run on
the current page. When a page is held in a frame, the script is
incorrectly executed on the outermost page, not the page where the URL
was located. This can be used to execute scripts in the context of an
unrelated frame, which allows cross-site scripting.


Opera's Response

Opera Software has released Opera 9.61, where this issue has been fixed.


Credits

Thanks to David Bloom for reporting this issue to Opera Software.

________________________________________________________________________

Advisory: Feed preview can reveal contents of unrelated news feeds



Severity

Highly Severe


Platforms

All desktop versions


Problem Description

When Opera is previewing a news feed, some scripts are not correctly
blocked. These scripts are able to subscribe the user to any feed URL
that the attacker chooses, and can also view the contents of any feeds
that the user is subscribed to. These may contain sensitive information.


Opera's Response

Opera Software has released Opera 9.61, where this issue has been fixed.


Credits

Thanks to David Bloom for reporting this issue to Opera Software.

______________________________________________________________________



======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================