Description
Opera before 7.54 allows remote attackers to modify properties and methods of the location object and execute Javascript to read arbitrary files from the client's local filesystem or display a false URL to the user.
References
- http://www.greymagic.com/security/advisories/gm008-op/
- 12233 third-party-advisory
- opera-location-method-overwrite(16904) vdb-entry
- http://www.opera.com/docs/changelogs/windows/754/
- GLSA-200408-05 vendor-advisory
- 10873 vdb-entry
- 8331 vdb-entry
- 20040805 Opera: Location, Location, Location mailing-list