ArchLinux: 201806-13: qutebrowser: cross-site scripting
Summary
qutebrowser before 1.3.3 contains a Cross Site Scripting (XSS) vulnerability that can result in a website stealing the user's browsing history. This attack can be exploitable by tricking the victim into opening a page with a specially crafted attribute, and then opening the qute://history site via the :history command.
Resolution
Upgrade to 1.3.3-1.
# pacman -Syu "qutebrowser>=1.3.3-1"
The problem has been fixed upstream in version 1.3.3.
References
https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7 https://github.com/qutebrowser/qutebrowser/issues/4011 https://security.archlinux.org/CVE-2018-1000559
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.