CVE-2022-29536: 
NixOS vulnerability analysis and mitigation

CVE-2022-29536 affects GNOME Epiphany (also known as GNOME Web) versions before 41.4 and 42.x before 42.2. The vulnerability allows an HTML document to trigger a client buffer overflow in the ephystringshorten function within the UI process via a long page title (NVD, Ubuntu).

The vulnerability is a buffer overflow condition that occurs in the ephystringshorten function of the browser's UI process. The issue is triggered when processing HTML documents with exceptionally long page titles (Debian Security).

When exploited, this vulnerability could allow an attacker to cause the GNOME Web browser to crash, resulting in a denial of service condition. Additionally, there is a possibility of arbitrary code execution (Ubuntu Notice).

The vulnerability has been fixed in GNOME Epiphany versions 41.4 and 42.2. Users are advised to upgrade to these or later versions. Various Linux distributions have released security updates: Debian has fixed it in version 3.38.2-1+deb11u3 for Bullseye, Ubuntu has released updates for versions 42.1-1ubuntu1 (22.04) and 3.36.4-0ubuntu2 (20.04), and Fedora has released version 42.2-1.fc36 for Fedora 36 (Debian Security, Ubuntu Notice, Fedora Update).