| The Opera browser has multiple vulnerabilities. From the Gentoo alert:
Opera does not restrict the ability of a framed web page to change
the address associated with a different frame (CVE-2008-4195).
Chris Weber (Casaba Security) discovered a Cross-site scripting
vulnerability (CVE-2008-4196).
Michael A. Puls II discovered that Opera can produce argument
strings that contain uninitialized memory, when processing custom
shortcut and menu commands (CVE-2008-4197).
Lars Kleinschmidt discovered that Opera, when rendering an HTTP
page that has loaded an HTTPS page into a frame, displays a padlock
icon and offers a security information dialog reporting a secure
connection (CVE-2008-4198).
Opera does not prevent use of links from web pages to feed source
files on the local disk (CVE-2008-4199).
Opera does not ensure that the address field of a news feed
represents the feed's actual URL (CVE-2008-4200).
Opera does not check the CRL override upon encountering a
certificate that lacks a CRL (CVE-2008-4292).
Chris (Matasano Security) reported that Opera may crash if it is
redirected by a malicious page to a specially crafted address
(CVE-2008-4694).
Nate McFeters reported that Opera runs Java applets in the context
of the local machine, if that applet has been cached and a page can
predict the cache path for that applet and load it from the cache
(CVE-2008-4695).
Roberto Suggi Liverani (Security-Assessment.com) reported that
Opera's History Search results does not escape certain constructs
correctly, allowing for the injection of scripts into the page
(CVE-2008-4696).
David Bloom reported that Opera's Fast Forward feature incorrectly
executes scripts from a page held in a frame in the outermost page
instead of the page the JavaScript URL was located (CVE-2008-4697).
David Bloom reported that Opera does not block some scripts when
previewing a news feed (CVE-2008-4698).
Opera does not correctly sanitize content when certain parameters
are passed to Opera's History Search, allowing scripts to be injected
into the History Search results page (CVE-2008-4794).
Opera's links panel incorrectly causes scripts from a page held in
a frame to be executed in the outermost page instead of the page
where the URL was located (CVE-2008-4795). | 