UBUNTU-CVE-2021-45086

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggestedfilename is used as the pdfname value in PDF.js.

References

Affected packages

Ubuntu:Pro:16.04:LTS / epiphany-browser

Package

Name: epiphany-browser
Purl: pkg:deb/ubuntu/epiphany-browser@3.18.11-0ubuntu1?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.16.3-1ubuntu1

3.18.0-1ubuntu2

3.18.1-1ubuntu1

3.18.3-0ubuntu1

3.18.5-0ubuntu1

3.18.5-0ubuntu1.1

3.18.10-0ubuntu1

3.18.11-0ubuntu1

Ubuntu:Pro:18.04:LTS / epiphany-browser

Package

Name: epiphany-browser
Purl: pkg:deb/ubuntu/epiphany-browser@3.28.6-0ubuntu1?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.26.1-1ubuntu1

3.26.1-1ubuntu2

3.26.1-1ubuntu4

3.26.5.1-1ubuntu1

3.27.90-1ubuntu1

3.28.0.1-1ubuntu1

3.28.1-1ubuntu1

3.28.5-0ubuntu1

3.28.6-0ubuntu1

Ubuntu:20.04:LTS / epiphany-browser

Package

Name: epiphany-browser
Purl: pkg:deb/ubuntu/epiphany-browser@3.36.4-0ubuntu2?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.36.4-0ubuntu2

Affected versions

3.*

3.34.1-1

3.34.1-1build1

3.36.0-1

3.36.1-1

3.36.2-0ubuntu1

3.36.3-0ubuntu1

3.36.4-0ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "3.36.4-0ubuntu2",
            "binary_name": "epiphany-browser"
        },
        {
            "binary_version": "3.36.4-0ubuntu2",
            "binary_name": "epiphany-browser-data"
        },
        {
            "binary_version": "3.36.4-0ubuntu2",
            "binary_name": "epiphany-browser-dbgsym"
        }
    ]
}