Source: epiphany-browser Version: 51.1-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988
Hi, The following vulnerability was published for epiphany-browser. CVE-2026-118599[0]: | A file overwrite vulnerability exists in Epiphany when installing | WebExtension packages from .xpi files. In src/webextension/ephy- | web-extension-manager.c, decompress_xpi_thread() used libarchive | with archive_read_support_format_all() (and filters), so the | installer did not require a real ZIP. A TAR file named *.xpi was | extracted. TAR supports hard-link entry types; with Epiphany's | archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a | crafted hard-link target can cause an attacker-chosen existing user- | writable file to be truncated and overwritten with attacker- | controlled content and mode bits, without a dedicated warning | dialog, when the user installs or opens the crafted .xpi. This is | related to but separate from the ZIP-slip path traversal fixed as | CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must | install or open a malicious WebExtension (.xpi). Affected: Epiphany | >= 47.0 (WebExtension XPI install path). Fixed: | https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 | (commit 0cc9ab55 — only enable ZIP format support). Upstream: | https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter | acknowledgment: Fernando Munoz If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-118599 https://www.cve.org/CVERecord?id=CVE-2026-118599 [1] https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 [2] https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 [3] https://gitlab.gnome.org/GNOME/epiphany/-/commit/0cc9ab5506689a4b82a4b1a41ad71e895cfa48d4 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
