CVE-2017-1000025 GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resulting in the remote exfil...
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resulting in the remote exfiltration of stored passwords for a selected set of websites.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/epiphany-browser(Debian:12) | < 3.22.6-1 | 3.22.6-1 |
| debian/epiphany-browser(Debian:13) | < 3.22.6-1 | 3.22.6-1 |
| debian/epiphany-browser(Debian:14) | < 3.22.6-1 | 3.22.6-1 |
| GNOME epiphany | = 3.18.0 | No fix listed |
| GNOME epiphany | = 3.18.1 | No fix listed |
| GNOME epiphany | = 3.18.2 | No fix listed |
| GNOME epiphany | = 3.18.3 | No fix listed |
| GNOME epiphany | = 3.18.4 | No fix listed |
| GNOME epiphany | = 3.18.5 | No fix listed |
| GNOME epiphany | = 3.18.6 | No fix listed |
| GNOME epiphany | = 3.18.7 | No fix listed |
| GNOME epiphany | = 3.18.8 | No fix listed |
| GNOME epiphany | = 3.18.9 | No fix listed |
| GNOME epiphany | = 3.18.10 | No fix listed |
| GNOME epiphany | = 3.20.0 | No fix listed |
| GNOME epiphany | = 3.20.1 | No fix listed |
| GNOME epiphany | = 3.20.2 | No fix listed |
| GNOME epiphany | = 3.20.3 | No fix listed |
| GNOME epiphany | = 3.20.4 | No fix listed |
| GNOME epiphany | = 3.20.5 | No fix listed |
| GNOME epiphany | = 3.20.6 | No fix listed |
| GNOME epiphany | = 3.22.0 | No fix listed |
| GNOME epiphany | = 3.22.1 | No fix listed |
| GNOME epiphany | = 3.22.2 | No fix listed |
| GNOME epiphany | = 3.22.3 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME epiphany | = 3.22.4 | No fix listed |
| GNOME epiphany | = 3.22.5 | No fix listed |
| GNOME epiphany | = 3.23.1 | No fix listed |
| GNOME epiphany | = 3.23.1.1 | No fix listed |
| GNOME epiphany | = 3.23.1.2 | No fix listed |
| GNOME epiphany | = 3.23.2 | No fix listed |
| GNOME epiphany | = 3.23.2.1 | No fix listed |
| GNOME epiphany | = 3.23.3 | No fix listed |
| GNOME epiphany | = 3.23.4 | No fix listed |
| ubuntu/epiphany(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/epiphany(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/epiphany(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/epiphany(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2017-1000025 vendor-advisory
- bugzilla.gnome.org issue-tracking vendor-advisory
- www.usenix.org technical-description third-party-advisory