Severity
Highly severe
Description
Widgets may use File I/O to create, read, modify, or delete files, with the user’s permission. When using this functionality, Opera should request permission from the user, and ask for a location to use for the files that will be manipulated. In some cases, Opera fails to ask for permission, and will allow the widget to specify the directory to use, instead of a directory specified by the user. The widget can then create, erase, or manipulate important files on the computer, allowing them to run code of the attacker’s choice.
Before the issue can be exploited, the user will need to accept installation of the widget, and will be warned against installing widgets from untrusted sources. Widgets that use File I/O will also display a warning during installation showing that they can read and write files on the computer, and the user will have the opportunity to cancel the installation.
Affected versions
This issue affects Opera for Windows and Mac.
Opera’s response
Opera Software has released Opera 10.54, where this issue has been fixed.