Description
Opera before 9.63 does not block unspecified "scripted URLs" during the feed preview, which allows remote attackers to read existing subscriptions and force subscriptions to arbitrary feed URLs.
References
- http://www.opera.com/docs/changelogs/linux/963/
- 34294 third-party-advisory
- http://www.opera.com/support/kb/view/923/
- GLSA-200903-30 vendor-advisory
- 1021461 vdb-entry