CVE catalog

CVE-2022-29536

epiphany-browser affected and fixed versions

[CVE catalog]

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.05% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixieepiphany-browser42.2-1FixedDistribution-reported fixed boundary[CVE-2022-29536]
Debiantrixieepiphany-browser48.5-0+deb13u1Fixed[CVE-2022-29536]
Debiansidepiphany-browser42.2-1FixedDistribution-reported fixed boundary[CVE-2022-29536]
Debiansidepiphany-browser51.1-1Fixed[CVE-2022-29536]
Debianforkyepiphany-browser42.2-1FixedDistribution-reported fixed boundary[CVE-2022-29536]
Debianforkyepiphany-browser51.1-1Fixed[CVE-2022-29536]
Debianbookwormepiphany-browser42.2-1FixedDistribution-reported fixed boundary[CVE-2022-29536]
Debianbookwormepiphany-browser43.1-1Fixed[CVE-2022-29536]

Showing 8 fix observations. All 42 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormepiphany-browser42.2-1FixedDistribution-reported fixed boundary[CVE-2022-29536]
Debianbookwormepiphany-browser43.1-1Fixed[CVE-2022-29536]
Debianforkyepiphany-browser42.2-1FixedDistribution-reported fixed boundary[CVE-2022-29536]
Debianforkyepiphany-browser51.1-1Fixed[CVE-2022-29536]
Debiansidepiphany-browser42.2-1FixedDistribution-reported fixed boundary[CVE-2022-29536]
Debiansidepiphany-browser51.1-1Fixed[CVE-2022-29536]
Debiantrixieepiphany-browser42.2-1FixedDistribution-reported fixed boundary[CVE-2022-29536]
Debiantrixieepiphany-browser48.5-0+deb13u1Fixed[CVE-2022-29536]
Opensusetumbleweedepiphany42.2-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:12025-1]
Ubuntu16.04epiphany-browser3.16.3-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu16.04epiphany-browser3.18.0-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu16.04epiphany-browser3.18.1-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu16.04epiphany-browser3.18.10-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu16.04epiphany-browser3.18.11-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu16.04epiphany-browser3.18.3-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu16.04epiphany-browser3.18.5-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu16.04epiphany-browser3.18.5-0ubuntu1.1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.26.1-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.26.1-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.26.1-1ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.26.5.1-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.27.90-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.28.0.1-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.28.1-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.28.5-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu18.04epiphany-browser3.28.6-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu20.04epiphany-browser3.34.1-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu20.04epiphany-browser3.34.1-1build1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu20.04epiphany-browser3.36.0-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu20.04epiphany-browser3.36.1-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu20.04epiphany-browser3.36.2-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu20.04epiphany-browser3.36.3-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu20.04epiphany-browser3.36.4-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu20.04epiphany-browser3.36.4-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu22.04epiphany-browser41.0-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu22.04epiphany-browser41.0-2UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu22.04epiphany-browser41.2-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu22.04epiphany-browser41.3-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu22.04epiphany-browser42.0-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu22.04epiphany-browser42.1-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu22.04epiphany-browser42.1-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Ubuntu22.04epiphany-browser42~beta-1UnknownSource applicability is not established[UBUNTU-CVE-2022-29536]
Original provider fields
{
  "package_releases": [
    {
      "name": "epiphany-browser",
      "status": "fixed",
      "release": "sid",
      "version": "51.1-1"
    },
    {
      "name": "epiphany-browser",
      "status": "fixed",
      "release": "forky",
      "version": "51.1-1"
    },
    {
      "name": "epiphany-browser",
      "status": "fixed",
      "release": "trixie",
      "version": "48.5-0+deb13u1"
    },
    {
      "name": "epiphany-browser",
      "status": "fixed",
      "release": "bookworm",
      "version": "43.1-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1009959,
      "name": "epiphany-browser",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "42.2-1"
    },
    {
      "bug": 1009959,
      "name": "epiphany-browser",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "42.2-1"
    },
    {
      "bug": 1009959,
      "name": "epiphany-browser",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "42.2-1"
    },
    {
      "bug": 1009959,
      "name": "epiphany-browser",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "42.2-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "epiphany-browser",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "3.16.3-1ubuntu1",
        "3.18.0-1ubuntu2",
        "3.18.1-1ubuntu1",
        "3.18.3-0ubuntu1",
        "3.18.5-0ubuntu1",
        "3.18.5-0ubuntu1.1",
        "3.18.10-0ubuntu1",
        "3.18.11-0ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-29536",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-29536",
      "provider_updated_at": "2026-02-04T02:16:02.362304Z",
      "applicability_unknown": true
    },
    {
      "name": "epiphany-browser",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "3.26.1-1ubuntu1",
        "3.26.1-1ubuntu2",
        "3.26.1-1ubuntu4",
        "3.26.5.1-1ubuntu1",
        "3.27.90-1ubuntu1",
        "3.28.0.1-1ubuntu1",
        "3.28.1-1ubuntu1",
        "3.28.5-0ubuntu1",
        "3.28.6-0ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-29536",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-29536",
      "provider_updated_at": "2026-02-04T02:16:02.362304Z",
      "applicability_unknown": true
    },
    {
      "name": "epiphany-browser",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.36.4-0ubuntu2"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "3.34.1-1",
        "3.34.1-1build1",
        "3.36.0-1",
        "3.36.1-1",
        "3.36.2-0ubuntu1",
        "3.36.3-0ubuntu1",
        "3.36.4-0ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-29536",
      "fixed_version": "3.36.4-0ubuntu2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-29536",
      "provider_updated_at": "2026-02-04T02:16:02.362304Z",
      "applicability_unknown": true
    },
    {
      "name": "epiphany-browser",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "42.1-1ubuntu1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "41.0-1",
        "41.0-2",
        "41.2-1",
        "41.3-1",
        "42~beta-1",
        "42.0-1",
        "42.1-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-29536",
      "fixed_version": "42.1-1ubuntu1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-29536",
      "provider_updated_at": "2026-02-04T02:16:02.362304Z",
      "applicability_unknown": true
    },
    {
      "name": "epiphany",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "42.2-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:12025-1",
      "fixed_version": "42.2-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:12025-1",
      "provider_updated_at": "2026-02-04T02:15:59.663924Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1009959]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [epiphany-browser]Unknown
    Details (2)

    • 43.1-1 · amd64 · bookworm

      Fixed · Fixed: 42.2-1

      dsa · epiphany-browser · debian · bookworm

    • 43.1-1 · arm64 · bookworm

      Fixed · Fixed: 42.2-1

      dsa · epiphany-browser · debian · bookworm

  • [epiphany-browser-data]Unknown

    Source package: [epiphany-browser]

    Details (2)

    • 43.1-1 · all · bookworm

      Fixed · Fixed: 42.2-1

      dsa · epiphany-browser · debian · bookworm

    • 43.1-1 · all · bookworm

      Fixed · Fixed: 42.2-1

      dsa · epiphany-browser · debian · bookworm

[openSUSE Tumbleweed]

  • [epiphany]Unknown

    Source package: [epiphany]

    Details (1)

    • 50.6-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 42.2-1.1

      dsa · epiphany · opensuse · tumbleweed

  • [epiphany-branding-upstream]Unknown

    Source package: [epiphany]

    Details (1)

    • 50.6-2.1 · noarch · tumbleweed

      Unknown · Fixed: 42.2-1.1

      Version impact unknown

      dsa · epiphany · opensuse · tumbleweed

  • [epiphany-lang]Unknown

    Source package: [epiphany]

    Details (1)

    • 50.6-2.1 · noarch · tumbleweed

      Unknown · Fixed: 42.2-1.1

      Version impact unknown

      dsa · epiphany · opensuse · tumbleweed

  • [gnome-shell-search-provider-epiphany]Unknown

    Source package: [epiphany]

    Details (1)

    • 50.6-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 42.2-1.1

      Version impact unknown

      dsa · epiphany · opensuse · tumbleweed

Observed:

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]