CVE-2018-11396
Fixed in a distro release EPSS 2%
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call.
Products: gnome epiphany
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | epiphany-browser | 3.28.2.1-1 |
| Debian 13 | epiphany-browser | 3.28.2.1-1 |
| Debian 14 | epiphany-browser | 3.28.2.1-1 |
| Ubuntu 16.04 LTS | epiphany-browser | no fix |
| Ubuntu 18.04 LTS | epiphany-browser | no fix |
| openSUSE Leap 15.0 | epiphany | 3.28.1.1-lp151.3.3.1 |
| openSUSE Leap 15.1 | epiphany | 3.28.1.1-lp151.3.3.1 |
| openSUSE Tumbleweed | epiphany | 40.3-2.1 |