The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3074 advisory.

  - XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as     demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page     on the Most Visited list. (CVE-2021-45085)

  - XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader     mode is used, as demonstrated by a a page title. (CVE-2021-45087)

  - XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.
    (CVE-2021-45088)

  - In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow     (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of     bytes for a UTF-8 ellipsis character is not properly considered. (CVE-2022-29536)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3074-1 : epiphany-browser - LTS security update

medium Nessus Plugin ID 164279

Version 1.3