Untrusted search path vulnerability in Epiphany's Python interface allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504363

Test case available in: http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Proposed patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=sanitizesys.path.diff;att=1;bug=504363

Patch notes: The path for affected file in Fedora is BUILD/epiphany-N.V.R/src/ephy-python.c, the proposed patch won't apply cleanly, but the change of:

++ / Sanitize sys.path to prevent relative imports loading modules in ++ the current working directory ++ / ++ PyRunSimpleString("import sys; sys.path = filter(None, sys.path)")

in ephy-python.c should be enough to fix this issue.