[ GLSA 200903-16 ] Epiphany: Untrusted search path

[GLSA]

Gentoo Linux Security Advisory

Title: Epiphany: Untrusted search path (GLSA 200903-16)
Severity: normal
Exploitable: local
Date: March 09, 2009
Bug(s): #257000
ID: 200903-16

Synopsis


An untrusted search path vulnerability in Epiphany might result in the
execution of arbitrary code.


Background


Epiphany is a GNOME webbrowser based on the Mozilla rendering engine
Gecko.


Affected Packages

Package: www-client/epiphany
Vulnerable: < 2.22.3-r2
Unaffected: >= 2.22.3-r2
Architectures: All supported architectures


Description


James Vega reported an untrusted search path vulnerability in the
Python interface.


Impact


A local attacker could entice a user to run Epiphany from a directory
containing a specially crafted python module, resulting in the
execution of arbitrary code with the privileges of the user running
Epiphany.


Workaround


Do not run "epiphany" from untrusted working directories.


Resolution


All Epiphany users should upgrade to the latest version: