PT-2021-24198 · Gnome+4 · Gnome Web+4

Published 2021-12-16 · Updated 2022-08-10 · CVE-2021-45086

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: GNOME Web (aka Epiphany) versions prior to 40.4 GNOME Web (aka Epiphany) versions 41.x prior to 41.1

Description: A security issue exists due to the use of a server's suggested filename as the pdf name value in PDF.js, leading to potential XSS.

Recommendations: For versions prior to 40.4, update to version 40.4 or later. For versions 41.x prior to 41.1, update to version 41.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-3546

ALT-PU-2021-3624

CVE-2021-45086

DSA-5042-1

MGASA-2022-0053

OESA-2022-1627

USN-5561-1

Affected Products

Alt Linux

Gnome Web

Linuxmint

Pdf.Js

Ubuntu

References · 26

• 🔥 https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45086 · Security Note
• https://ubuntu.com/security/CVE-2021-45085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45087 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29536 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1627 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45086 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5561-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45086 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0053 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45086 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-45086 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45086 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45088 · Security Note