A number of security vulnerabilities were repaired in the latest version of the Opera browser, which was released today. However, a security researcher says that users who downloaded the browser from Apple’s Mac App Store won’t have access to version 12.13; in fact you’ll be two revs behind as of today.
Graham Cluley of Sophos reported today that Opera 12.11 is the latest version available at the Mac App Store. Version 12.12 was released Dec. 18.
“The Mac App Store may be a convenient one-stop-shop for Mac users to get their software from, but it sure does a poor job at keeping that software up-to-date and ensuring that users are protected against the latest vulnerabilities,” Cluley said. “Anyone who is relying on the App Store to keep their Opera browser updated, and free from security vulnerabilities is being let down badly.”
Opera, meanwhile, fixed four security issues in version 12.13.
The first patch fixes a bug in particular document object model (DOM) manipulations that could cause the browser to crash. In some cases, the crashes could allow for arbitrary code execution.
Opera also patched vulnerability in how the browser handles scalable vector graphics (SVG) documents with specific clipPaths. “Opera may allow other content to overwrite the memory, before referencing the memory, which will lead to a crash,” the Opera advisory said. “If an attacker can control the contents being written into memory, execution of arbitrary code may occur.”
A patch was also issued to address a vulnerability in how Opera handles cross-origin resource sharing (CORS) requests which could override a browser’s cross-site request forgery protection.
“An attacking site could provide that same static header value, and bypass the preflight request, allowing it to submit the request to the target site without permission,” the advisory said. “In such cases, the HTTP Referer header is sent correctly, which may be used by the target site to detect the attack.”
A fourth low-severity issue was also patched, but Opera declined to share details.
