Opera denies refusing to patch critical vulnerability

Posted on November 1, 2011 by iGennie Technical Services

Opera has released an update a week ago, to overcome the vulnerabilities coming across during the handling of Scalable Vector Graphics (SVG) in its desktop browser. The company had earlier refused to release security patches for this problem. But, now the company denies its refusal.

“In this post, I do the release of an issue that I discovered 362 days ago and it was reported to Opera using the SSD program (SecuriTeam Secure Disclosure), but they have decided not to fix it,” as was posted in a blog by security researcher Jose A. Vázquez on Oct. 10.

This issue came in existence when an error occurred in Opera’s SVG handling code. Due to this error, the desktop browser could exploit to execute arbitrary code. It could trick the victims and load specially crafted SVG images having malformed fonts.

Opera authorities admit that they were informed about this issue six months ago, but couldn’t resolve it. They claim not to have found any replicate for resolving the issue. Opera quality assurance engineer Sigbjørn Vik admitted on the release of the patch, “In this case, the issue had only been confirmed for older versions of Opera, not the current version, at the time of it being reported, and the recently published information contained details that were not included in the original report, and which appear to be relevant to reproducing the issue,”

“With our release today of Opera 11.52, we have a fix available for this issue, less than a week after being made aware of the relevant details. [...] We recommend that all Opera users download and install this newest version patch,” the engineer added.

Apart from the patch for the SVG vulnerability, Opera 11.52 also includes other features, such as fixes for non-security issues with HTML5 videos, BitTorrent downloads and X-Frame-Options error pages.