ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to     cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as     demonstrated by a crafted window.open call. (CVE-2018-11396)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for epiphany fixes the following issues :

  - CVE-2018-11396: Fixed a JavaScript crash when an invalid     URI is opened (boo#1094464).

- Fix CVE-2018-11396/CVE-2018-12016 (#795740)

  - Allow Ctrl+T in app mode again due to unintended     consequences (#796204)

  - Don't remember passwords when the setting is disabled     (#796219)

  - Fix password manager crash on chase.com (GitLab #11)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Ensure search engine migration does not fail (#794645)

  - Do not open adblock filters when automatic open     downloads is enabled (#794646)

  - Fix crash destroying sync service (#794728)

  - Fix CVE-2018-11396/CVE-2018-12016 (#795740)

  - Do not use Fanboy's Annoyance adblock list by default     (#796245)

  - Fix a couple sync service crashers (Gabriel Ivascu)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
256912	Linux Distros Unpatched Vulnerability : CVE-2018-11396	Nessus	Misc.	high
129999	openSUSE Security Update : epiphany (openSUSE-2019-2318)	Nessus	SuSE Local Security Checks	high
120678	Fedora 28 : 1:epiphany (2018-a5e45fc9f7)	Nessus	Fedora Local Security Checks	high
110673	Fedora 27 : 1:epiphany (2018-de5457b0a2)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-11396

high

Tenable Plugins

high

high

high

high