Advisories » MGASA-2022-0382

Updated epiphany packages fix security vulnerability

Publication date: 23 Oct 2022
Modification date: 23 Oct 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-29536

Description

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can
trigger a client buffer overflow (in ephy_string_shorten in the UI
process) via a long page title. The issue occurs because the number of
bytes for a UTF-8 ellipsis character is not properly considered.
(CVE-2022-29536)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=30365
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GLLDMY4JYDZTMZSCPSY23K5YW3SQYUR6/
• https://ubuntu.com/security/notices/USN-5561-1
• https://www.debian.org/security/2022/dsa-5208
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29536

SRPMS

8/core

• epiphany-3.38.2-1.2.mga8