Bugzilla – Bug 1094464
VUL-1: CVE-2018-11396 epiphany: denial of service in ephy-session.c
Last modified: 2020-01-16 13:10:36 UTC
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call. References: https://bugzilla.redhat.com/show_bug.cgi?id=1581801 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11396 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-11396.html http://www.cvedetails.com/cve/CVE-2018-11396/ https://bugzilla.gnome.org/show_bug.cgi?id=795740
This is an autogenerated message for OBS integration: This bug (1094464) was mentioned in https://build.opensuse.org/request/show/613058 Factory / epiphany
This is automated batch bugzilla cleanup. The openSUSE 42.3 changed to end-of-life (EOL [1]) status. As such it is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of openSUSE (At this moment openSUSE Leap 15.1, 15.0 and Tumbleweed) please feel free to reopen this bug against that version (!you must update the "Version" component in the bug fields, do not just reopen please), or alternatively create a new ticket. Thank you for reporting this bug and we are sorry it could not be fixed during the lifetime of the release. [1] https://en.opensuse.org/Lifetime
15.0 and 15.1 still unfixed
*** Bug 1096688 has been marked as a duplicate of this bug. ***
This is an autogenerated message for OBS integration: This bug (1094464) was mentioned in https://build.opensuse.org/request/show/736455 15.1 / epiphany https://build.opensuse.org/request/show/736456 15.0 / epiphany https://build.opensuse.org/request/show/736458 Backports:SLE-15-SP1 / epiphany https://build.opensuse.org/request/show/736459 Backports:SLE-15 / epiphany
openSUSE-SU-2019:2318-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1094464 CVE References: CVE-2018-11396 Sources used: openSUSE Leap 15.1 (src): epiphany-3.28.1.1-lp151.3.3.1 openSUSE Leap 15.0 (src): epiphany-3.28.1.1-lp150.2.3.1
done. Closing