Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-11396 — Epiphany vulnerability

9 documents7 sources

Severity

7.5HIGHNVD

EPSS

0.7%

top 28.29%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Gnome Epiphany

Timeline

PublishedMay 23

Latest updateMay 13

Description

ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDgnome/epiphany3.28.2.1

🔴Vulnerability Details

GHSA

GHSA-xh97-73h5-gfm9: ephy-session↗2022-05-13

▶

CVEList

CVE-2018-11396: ephy-session↗2018-05-23

▶

OSV

CVE-2018-11396: ephy-session↗2018-05-23

▶

💥Exploits & PoCs

Exploit-DB

Epiphany 3.28.2.1 - Denial of Service↗2018-06-01

▶

📋Vendor Advisories

Debian

CVE-2018-11396: epiphany-browser - ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 al...↗2018

▶

💬Community

Bugzilla

CVE-2018-12016 epiphany: Denial of service via window.open and document.write calls↗2018-06-07

▶

Bugzilla

CVE-2018-11396 epiphany: denial of service in ephy-session.c [fedora-all]↗2018-05-23

▶

Bugzilla

CVE-2018-11396 epiphany: denial of service in ephy-session.c↗2018-05-23

▶