Bug#1009959: epiphany-browser: CVE-2022-29536

[Salvatore Bonaccorso]

Source: epiphany-browser
Version: 42.1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 3.38.2-1
Control: found -1 3.32.1.2-3

Hi,

The following vulnerability was published for epiphany-browser.

CVE-2022-29536[0]:
| In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document
| can trigger a client buffer overflow (in ephy_string_shorten in the UI
| process) via a long page title. The issue occurs because the number of
| bytes for a UTF-8 ellipsis character is not properly considered.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-29536
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29536
[1] https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1106

Regards,
Salvatore