A vulnerability has been discovered in Epiphany, which can lead to a buffer overflow.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-client/epiphany | * | < 42.4 | >= 42.4 |
Epiphany is a GNOME webbrowser based on the Mozilla rendering engine Gecko.
A vulnerability has been discovered in Epiphany. Please review the CVE identifier referenced below for details.
In GNOME Epiphany an HTML document can trigger a client buffer overflow (in ephy_string_shorten) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.
There is no known workaround at this time.
All Epiphany users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/epiphany-42.4"
An untrusted search path vulnerability in Epiphany might result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-client/epiphany | * | < 2.22.3-r2 | >= 2.22.3-r2 |
Epiphany is a GNOME webbrowser based on the Mozilla rendering engine Gecko.
James Vega reported an untrusted search path vulnerability in the Python interface.
A local attacker could entice a user to run Epiphany from a directory containing a specially crafted python module, resulting in the execution of arbitrary code with the privileges of the user running Epiphany.
Do not run "epiphany" from untrusted working directories.
All Epiphany users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/epiphany-2.22.3-r2"
New releases of Mozilla, Epiphany, Mozilla Thunderbird, and Mozilla Firefox fix several vulnerabilities, including the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/mozilla-thunderbird | * | < 0.8 | >= 0.8 |
| mail-client/mozilla-thunderbird-bin | * | < 0.8 | >= 0.8 |
| www-client/epiphany | * | < 1.2.9-r1 | >= 1.2.9-r1 |
| www-client/mozilla | * | < 1.7.3 | >= 1.7.3 |
| www-client/mozilla-bin | * | < 1.7.3 | >= 1.7.3 |
| www-client/mozilla-firefox | * | < 1.0_pre | >= 1.0_pre |
| www-client/mozilla-firefox-bin | * | < 1.0_pre | >= 1.0_pre |
Mozilla is a popular web browser that includes a mail and newsreader. Epiphany is a web browser that uses Gecko, the Mozilla rendering engine. Mozilla Firefox and Mozilla Thunderbird are respectively the next-generation browser and mail client from the Mozilla project.
Mozilla-based products are vulnerable to multiple security issues. Firstly routines handling the display of BMP images and VCards contain an integer overflow and a stack buffer overrun. Specific pages with long links, when sent using the "Send Page" function, and links with non-ASCII hostnames could both cause heap buffer overruns.
Several issues were found and fixed in JavaScript rights handling: untrusted script code could read and write to the clipboard, signed scripts could build confusing grant privileges dialog boxes, and when dragged onto trusted frames or windows, JavaScript links could access information and rights of the target frame or window. Finally, Mozilla-based mail clients (Mozilla and Mozilla Thunderbird) are vulnerable to a heap overflow caused by invalid POP3 mail server responses.
An attacker might be able to run arbitrary code with the rights of the user running the software by enticing the user to perform one of the following actions: view a specially-crafted BMP image or VCard, use the "Send Page" function on a malicious page, follow links with malicious hostnames, drag multiple JavaScript links in a row to another window, or connect to an untrusted POP3 mail server. An attacker could also use a malicious page with JavaScript to disclose clipboard contents or abuse previously-given privileges to request XPI installation privileges through a confusing dialog.
There is no known workaround covering all vulnerabilities.
All users should upgrade to the latest stable version:
# emerge sync # emerge -pv your-version # emerge your-version
New releases of Mozilla, Epiphany, Galeon, Mozilla Thunderbird, and Mozilla Firefox fix several vulnerabilities, including remote DoS and buffer overflows.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/mozilla-thunderbird | * | < 0.7.3 | >= 0.7.3 |
| mail-client/mozilla-thunderbird-bin | * | < 0.7.3 | >= 0.7.3 |
| www-client/epiphany | * | < 1.2.7-r1 | >= 1.2.7-r1 |
| www-client/galeon | * | < 1.3.17 | >= 1.3.17 |
| www-client/mozilla | * | < 1.7.2 | >= 1.7.2 |
| www-client/mozilla-bin | * | < 1.7.2 | >= 1.7.2 |
| www-client/mozilla-firefox | * | < 0.9.3 | >= 0.9.3 |
| www-client/mozilla-firefox-bin | * | < 0.9.3 | >= 0.9.3 |
Mozilla is a popular web browser that includes a mail and newsreader. Galeon and Epiphany are both web browsers that use gecko, the Mozilla rendering engine. Mozilla Firefox is the next-generation browser from the Mozilla project that incorporates advanced features that are yet to be incorporated into Mozilla. Mozilla Thunderbird is the next-generation mail client from the Mozilla project.
Mozilla, Galeon, Epiphany, Mozilla Firefox and Mozilla Thunderbird contain the following vulnerabilities:
Mozilla, Mozilla Firefox, and other gecko-based browsers also contain a bug in their caching which may allow the SSL icon to remain visible, even when the site in question is an insecure site.
Users of Mozilla, Mozilla Firefox, and other gecko-based browsers are susceptible to SSL certificate spoofing, a Denial of Service against legitimate SSL sites, crashes, and arbitrary code execution. Users of Mozilla Thunderbird are susceptible to crashes and arbitrary code execution via malicious e-mails.
There is no known workaround for most of these vulnerabilities. All users are advised to upgrade to the latest available version.
All users should upgrade to the latest stable version:
# emerge sync # emerge -pv your-version # emerge your-version