Bug 1101507 (CVE-2018-1000559) - VUL-0: CVE-2018-1000559: qutebrowser: Cross Site Scripting (XSS) vulnerability in history command
Summary: VUL-0: CVE-2018-1000559: qutebrowser: Cross Site Scripting (XSS) vulnerabilit...
Status: RESOLVED FIXED
Alias: CVE-2018-1000559
Product: openSUSE Distribution
Classification: openSUSE
Component: Basesystem (show other bugs)
Version: Leap 15.0
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Alexei Sorokin
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-07-17 16:08 UTC by Alexander Bergmann
Modified: 2018-12-17 00:00 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2018-07-17 16:08:40 UTC 
CVE-2018-1000559

Description

qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be exploitable via the victim must open a page with a specially crafted <title> attribute, and then open the qute://history site via the :history command. This vulnerability appears to have been fixed in fixed in v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2018-1000559
Comment 1 Swamp Workflow Management 2018-07-17 21:50:10 UTC 
This is an autogenerated message for OBS integration:
This bug (1101507) was mentioned in
https://build.opensuse.org/request/show/623516 42.3 / qutebrowser
https://build.opensuse.org/request/show/623517 15.0 / qutebrowser
Comment 2 Swamp Workflow Management 2018-07-28 14:00:11 UTC 
openSUSE-SU-2018:2120-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1100968,1101507
CVE References: CVE-2018-1000559,CVE-2018-10895
Sources used:
openSUSE Leap 15.0 (src):    qutebrowser-1.4.1-lp150.2.3.1
Comment 3 Swamp Workflow Management 2018-07-28 14:04:21 UTC 
openSUSE-SU-2018:2130-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1101507
CVE References: CVE-2018-1000559
Sources used:
openSUSE Leap 42.3 (src):    qutebrowser-0.11.1-2.3.1
Comment 4 Marcus Meissner 2018-08-05 11:15:33 UTC 
released
Comment 5 Alexei Sorokin 2018-08-05 20:31:27 UTC 
Released it is.