Mozilla isn’t the only alternative browser maker struggling with serious security problems.
On the same day Mozilla shipped a Firefox update to fix multiple critical vulnerabilities, Opera dropped a major patch to fix three documented flaws, including a memory corruption issue that exposes users to code execution attacks.
[ SEE: Firefox hit by multiple drive-by download flaws ]
Here’s the skinny:
- Advisory #1: Specially crafted domain names can cause a memory corruption in Opera, which may lead to a crash. Successful exploitation can lead to execution of arbitrary code. Rated “extremely severe.”
- Advisory #2: Opera may allow scripts to run on the feed subscription page, thereby gaining access to the feeds object. This can be used for automatic subscription of feeds, or reading other feeds. (Less severe)
- Advisory #3: In some cases, a Web font intended to be used for page content could be incorrectly used by Opera to render parts of the user interface, including the address field. This can be used by a malicious site to display a false domain name in the address field. (Less severe)
Patches for these flaws area available in Opera 10.01.
