Description
The Fast Forward feature in Opera before 9.61, when a page is located in a frame, executes a javascript: URL in the context of the outermost page instead of the page that contains this URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
References
- 32394 third-party-advisory
- http://www.opera.com/docs/changelogs/mac/961/
- ADV-2008-2873 vdb-entry
- [oss-security] 20081021 Re: CVE Request: Opera 9.60 with security fixes mailing-list
- 32538 third-party-advisory
- 32299 third-party-advisory
- http://www.opera.com/docs/changelogs/solaris/961/
- [oss-security] 20081022 Re: CVE Request: Opera 9.60 with security fixes mailing-list
- opera-fastforward-xss(46004) vdb-entry
- http://www.opera.com/docs/changelogs/windows/961/
- http://www.opera.com/docs/changelogs/linux/961/
- SUSE-SR:2008:022 vendor-advisory
- http://www.opera.com/docs/changelogs/freebsd/961/
- http://www.opera.com/support/search/view/904/
- 31842 vdb-entry
- GLSA-200811-01 vendor-advisory