CVE-2022-29536

NameCVE-2022-29536
DescriptionIn GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3074-1, DSA-5208-1
Debian Bugs1009959

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
epiphany-browser (PTS)jessie3.14.1-1vulnerable
stretch3.22.7-1fixed
buster (security), buster, buster (lts)3.32.1.2-3~deb10u3fixed
bullseye (security), bullseye3.38.2-1+deb11u3fixed
bookworm43.1-1fixed
trixie47.0-1fixed
sid47.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
epiphany-browsersourcejessie(unfixed)end-of-life
epiphany-browsersourcestretch(not affected)
epiphany-browsersourcebuster3.32.1.2-3~deb10u2DLA-3074-1
epiphany-browsersourcebullseye3.38.2-1+deb11u3DSA-5208-1
epiphany-browsersource(unstable)42.2-11009959

Notes

[stretch] - epiphany-browser <not-affected> (Vulnerable code not present)
https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1106
Introduced by: https://gitlab.gnome.org/GNOME/epiphany/-/commit/232c613472b38ff0d0d97338f366024ddb9cd228 (3.29.2)
Fixed by: https://gitlab.gnome.org/GNOME/epiphany/-/commit/486da133569ebfc436c959a7419565ab102e8525

Search for package or bug name: Reporting problems