PT-2005-3843 · Opera · Opera

Jakob Balle · Published 2005-09-21 · Updated 2017-07-11 · CVE-2005-3006

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opera versions prior to 8.50

Description The issue allows remote attackers to inject arbitrary web script and potentially spoof attachment filenames by opening attached files from the user's cache directory without warning. This might occur when arbitrary JavaScript is executed in the context of "file://", potentially leading to a loss of confidentiality if a user chooses to view an attachment.

Recommendations For Opera versions prior to 8.50, update to version 8.50 or later to resolve the issue. As a temporary workaround, consider avoiding the execution of arbitrary JavaScript in the context of "file://" and be cautious when viewing attachments to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3006

Affected Products

Opera

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2005-3006 · Security Note
• http://secunia.com/secunia_research/2005-42/advisory · Vendor Advisory
• http://securityfocus.com/advisories/9339 · Vendor Advisory
• http://secunia.com/advisories/16645 · Vendor Advisory
• http://osvdb.org/19508 · Patch
• http://marc.info/?l=bugtraq&m=112724692219695&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22335 · Note
• http://opera.com/docs/changelogs/windows/850 · Note
• http://securityfocus.com/bid/14880 · Note
• http://opera.com/docs/changelogs/linux/850 · Note
• http://vupen.com/english/advisories/2005/1789 · Note
• http://xforce.iss.net/xforce/xfdb/22335 · Note