Re: CVE Request -- Opera Manipulating fonts in SVG can allow execution of arbitrary code

[Yves-Alexis Perez <corsac () debian org>]

On ven., 2011-10-28 at 07:17 -0400, Sean Amoss wrote:
> Can a CVE be assigned for the below issue?
>
> "Certain font manipulations inside a dynamically added and
> specifically
> embedded SVG image can cause Opera to crash. Additional techniques can
> reliably be used in combination with this crash to allow execution of
> arbitrary code.
>
> Opera Software has released Opera 11.52, where this issue has been
> fixed."
>
> http://www.opera.com/support/kb/view/1002/
> http://spa-s3c.blogspot.com/2011/10/spas3c-sv-006opera-browser-101112-0-day.html 

Note that *OSS*-sec is for Open Source Software, which Opera is not,
afair.

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part