Opera and QuickTime updates slay buffer bugs
Client side fixes are go
Opera has fixed a high-risk flaw in its browser software.
Version 10.61 of the Opera resolves a heap overflow vulnerability involving the HTML5 Canvas components of the browser. Left untreated, the flaw would create a possible mechanism for hackers to inject hostile code onto vulnerable systems, possibly via drive-by download-style attacks.
Opera version 10.61 - a cross-platform release for Mac and Unix as well as Windows machines - also fixed two less severe security flaws involving tabs and embedded scripts in news feeds. Windows (here) and Mac (here) release notes explain that the latest version of the browser also contains various stability and interface tweaks.
Thursday's update is the first for Opera since the start of July.
In other patching news, Apple published a new version of QuickTime for Windows on Thursday that patches a stack buffer overflow vulnerability in the media player's error logging sub-routines. Mac OS X users are not affected by the vulnerability, which creates a risk for QuickTime on Windows fans who try to view maliciously constructed movie files. Apple advises Windows users to upgrade to version 7.6.7 of QuickTime, as explained in an advisory here. ®