From foxboron@archlinux.org Tue Jun 26 19:58:21 2018
From: Morten Linderud <foxboron@archlinux.org>
To: arch-security@lists.archlinux.org
Subject: [ASA-201806-13] qutebrowser: cross-site scripting
Date: Tue, 26 Jun 2018 21:58:13 +0200
Message-ID: <20180626195812.GB4340@theia>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8003458644929881353=="

--===============8003458644929881353==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Arch Linux Security Advisory ASA-201806-13
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Severity: Medium
Date    : 2018-06-26
CVE-ID  : CVE-2018-1000559
Package : qutebrowser
Type    : cross-site scripting
Remote  : Yes
Link    : https://security.archlinux.org/AVG-724

Summary
=3D=3D=3D=3D=3D=3D=3D

The package qutebrowser before version 1.3.3-1 is vulnerable to cross-
site scripting.

Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Upgrade to 1.3.3-1.

# pacman -Syu "qutebrowser>=3D1.3.3-1"

The problem has been fixed upstream in version 1.3.3.

Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

None.

Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

qutebrowser before 1.3.3 contains a Cross Site Scripting (XSS)
vulnerability that can result in a website stealing the user's browsing
history. This attack can be exploitable by tricking the victim into
opening a page with a specially crafted <title> attribute, and then
opening the qute://history site via the :history command.

Impact
=3D=3D=3D=3D=3D=3D

A remote attacker is able to steal the browser history with a specially
crafted web page title.

References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30=
c45161cf405c7
https://github.com/qutebrowser/qutebrowser/issues/4011
https://security.archlinux.org/CVE-2018-1000559

--===============8003458644929881353==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUFCQ2dBZEZpRUV3UUEwWm5aalRv
REpRUHVlbkFML1FaL3N2aFlGQWxzeW10TUFDZ2tRbkFML1FaL3MKdmhiejBRLzhETGtSNWFEbzIv
TFhOcXVtMkhpV1k0VVV1bjFNNzJaa0VSOFYwWU81ZHpMSngwelJsUkc1SzJHKwphNnpEblh4Ri94
bVZsbFBCUm5XRUdWU3dsOGc5SHgzY0twRTZQWlVmc0xRVmFMOS9tL1cyNG5HK09nOUE1OE9qCmhq
NXdjbU9vK0NLMkZTWEY0ZHpVdGdQRWFWeGJaSGV6U1VuTDBPY2RlcGRJZ3Z5WXBqWEJRM1VBNytT
OVRFR1AKcEM2RWlqUldRQ1IwOHVKNDZnSWpSdFl0UGxiN2d3SkVRK3NIZ1hnWlBJODNwK3FVQnYr
MlRsaTQvOVJTUXVjSwppOVdzM2pOOFFoT1ZlM2p0LzI1M0R5dTNqZy9WdjUxbTgyVTVoRHZleEsw
WWhlcXltMmJkRU1sQ1lPUk9RUmpZCnliQkQzQ2pSekhoV2lzU2FFVm1STFpkdU1ZMTV6VEZmZkdj
ZHhqWEk3bDJDT2t5SzgzdTNFUm5odDJNdGhnQzgKQ3dDbzdFRmdMR2VGKzAzV2tMMDBtUXpPbmty
akxnUnhDcUJwTkh4dUNkbXpROFBncitJLzEwRTd1ZHN3RzM3SApCQjRNQ0dMdHdzVEJNQ0NSUFpV
OVFJQUNReVZuU3hDSjJkUmpTT2ZnTXVrOStTVUJ5Tmlvd1RRU2kzZWZiNTJ2Ck5EbnJIMzYzZjJJ
UXBLNVgyQ1d6aStsbU0yWFc3Q21pc2FLY0V1R1hLcVlxcmpiK1ZCbG5Id281NFdUNjdUdzkKY05a
b2pWdzA2T1RScFRiczgyWFd5MHNFVS90QUdKRUN0WTRuemdQS09Fa084WnNSbStycGw4R3Y3RmRL
akRwUQpHU0tOL1I1NnJObVVWdUFvRXpycFVXNFlEZ2hCU3l2dG1rQlk1WUFyTzVhQzNsUGVRUUE9
Cj04clFYCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo=

--===============8003458644929881353==--