MGASA-2022-0053 - Updated epiphany packages fix security vulnerability

Publication date: 09 Feb 2022
URL: https://advisories.mageia.org/MGASA-2022-0053.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-45085,
     CVE-2021-45086,
     CVE-2021-45087,
     CVE-2021-45088

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1
via an about: page, as demonstrated by ephy-about:overview when a user
visits an XSS payload page often enough to place that page on the Most
Visited list (CVE-2021-45085).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1
because a server's suggested_filename is used as the pdf_name value in
PDF.js (CVE-2021-45086).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1
when View Source mode or Reader mode is used, as demonstrated by a a page
title (CVE-2021-45087).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1
via an error page (CVE-2021-45088).

References:
- https://bugs.mageia.org/show_bug.cgi?id=29886
- https://www.debian.org/security/2022/dsa-5042
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45085
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45086
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45087
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45088

SRPMS:
- 8/core/epiphany-3.38.2-1.1.mga8