[From nobody Mon Nov 2 12:37:11 2026 Received: (at submit) by bugs.debian.org; 1 Nov 2026 19:53:53 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-108.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,MD5_SHA1_SUM,SPF_HELO_NONE,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 30; hammy, 150; neutral, 86; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:49342) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xNbcn-000oiT-1I for submit@bugs.debian.org; Sun, 01 Nov 2026 19:53:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Transfer-Encoding:Content-Type :MIME-Version:Message-ID:Subject:To:From:Date:Reply-To:Cc:Content-ID: Content-Description:In-Reply-To:References; bh=WEQedS8kAME1PKIy7Vs/KhlEbYj5d4yAW5Y60n3fj+U=; b=O8GvEDW8KlIzRAR/YlMiZc1dwV rV5+cUL0pw6arrZRzuwdYP4tSH/vMCDU+sQl9CY+rwo8sng4taYBSerJV3ncmmIIjvT5Bb206Krpb W5mMXZyxCTbNzShNKM+kIrAYWEfC6IMjpHNhVAjLB9rQvqKRh1PojDl3GlUzqwEMRxk0R82rwpoPj W5BS6HYN/iPhDGNgGXyu+t1vBtTNju6NOAJFuUcD69zZ5zSphxmiLcxFEewoX4g2Fk0+sLmcz2eRV Q4cWdbiQXC9pfGA8Tl6oH33a0Vv1nx2Oor/cc3fkVQtRFDF2YQyr/c/vyMoRnARCMhOyc1gFqKrRA v+4itP+w==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xNbck-005ckk-16 for submit@bugs.debian.org; Sun, 01 Nov 2026 19:53:52 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id F1706DC12B7; Sun, 01 Nov 2026 20:53:49 +0100 (CET) Date: Sun, 1 Nov 2026 20:53:49 +0100 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: epiphany-browser: CVE-2026-118599 Message-ID: <aueYzSY--WtYHjJi@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: epiphany-browser Version: 51.1-1 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Hi, The following vulnerability was published for epiphany-browser. CVE-2026-118599[0]: | A file overwrite vulnerability exists in Epiphany when installing | WebExtension packages from .xpi files. In src/webextension/ephy- | web-extension-manager.c, decompress_xpi_thread() used libarchive | with archive_read_support_format_all() (and filters), so the | installer did not require a real ZIP. A TAR file named *.xpi was | extracted. TAR supports hard-link entry types; with Epiphany's | archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a | crafted hard-link target can cause an attacker-chosen existing user- | writable file to be truncated and overwritten with attacker- | controlled content and mode bits, without a dedicated warning | dialog, when the user installs or opens the crafted .xpi. This is | related to but separate from the ZIP-slip path traversal fixed as | CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must | install or open a malicious WebExtension (.xpi). Affected: Epiphany | >= 47.0 (WebExtension XPI install path). Fixed: | https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 | (commit 0cc9ab55 — only enable ZIP format support). Upstream: | https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter | acknowledgment: Fernando Munoz If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-118599 https://www.cve.org/CVERecord?id=CVE-2026-118599 [1] https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 [2] https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 [3] https://gitlab.gnome.org/GNOME/epiphany/-/commit/0cc9ab5506689a4b82a4b1a41ad71e895cfa48d4 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]