Advisories » MGASA-2022-0053

Updated epiphany packages fix security vulnerability

Publication date: 09 Feb 2022
Modification date: 09 Feb 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2021-45085 , CVE-2021-45086 , CVE-2021-45087 , CVE-2021-45088

Description

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1
via an about: page, as demonstrated by ephy-about:overview when a user
visits an XSS payload page often enough to place that page on the Most
Visited list (CVE-2021-45085).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1
because a server's suggested_filename is used as the pdf_name value in
PDF.js (CVE-2021-45086).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1
when View Source mode or Reader mode is used, as demonstrated by a a page
title (CVE-2021-45087).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1
via an error page (CVE-2021-45088).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=29886
• https://www.debian.org/security/2022/dsa-5042
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45085
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45086
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45087
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45088

SRPMS

8/core

• epiphany-3.38.2-1.1.mga8