Improper input validation in GNOME Web (Epiphany) - CVE-2018-11396
Published: July 3, 2018 / Updated: June 17, 2021
Vulnerability identifier: #VU13557
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-11396
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists in ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) due to insufficient validation of user-supplied input. A remote attacker can supply JavaScript code, trigger access to a NULL URL, as demonstrated by a crafted window.open call and cause the service to crash.
Affected software
GNOME Web (Epiphany)
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse
Fedora
epiphany
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse
Fedora
epiphany
How to mitigate CVE-2018-11396
Install update from vendor's website.
epiphany - addressed in versions 3.26.7-1.fc27, 3.28.3-1.fc28, 3.28.3.1-1.fc28