This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-45086 →
DEBIAN-CVE-2021-45086
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF....
Original description
The description as published by the source.
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
epiphany-browser
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-1"}]}]
Debian:13
epiphany-browser
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-1"}]}]
Debian:14
epiphany-browser
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-1"}]}]
References
- advisory security-tracker.debian.org