Risk: Medium
Opera has updated its browser to defend against a vulnerability that could allow an attacker to spy on private emails or computer files.
A flaw in versions of Opera prior to 7.54 makes it possible for attackers to read (but not alter) files on a victim's PC or snoop on emails written or received by M2, Opera's mail program. The vulnerability also opens the door to cookie theft, URL spoofing (which can be used in phishing attacks) or tracking a user's browsing history.
Opera version 7.53 and prior on Windows, Linux and Mac are all affected by the flaw. Users are urged to update to Opera version 7.54, which defends against this exploit.
The vulnerability was discovered by Israeli security researchers GreyMagic Software, who have produced an advisory and proof of concept demo to highlight their concerns. "The vulnerability is a new variant of an older vulnerability GreyMagic detected in February last year. This time the 'location' object isn't sufficiently protected from malicious attacks," it explains.
It's been an indifferent time so far for users of alternative browsers. Mozilla posted updates for its Firefox browser, Thunderbird email client and Mozilla suite to defend against various security holes. The release includes a fix for a vulnerability involving a library for the Portable Networks Graphic (PNG) image format used by several software vendors including the Mozilla Project.
IE users might be permitted a wry smile at others' misfortune, if they weren't so busy patching their browser instead.