qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites
    to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL,
    which then sets 'editor.command' to a bash script, resulting in arbitrary code execution. (CVE-2018-10895)

This update for qutebrowser fixes the following issues :

Security issue fixed :

  - CVE-2018-1000559: Fix an XSS issue on qute://history     (boo#1101507).

  - CVE-2018-10895: Fix CSRF issue on the qute://settings     page (boo#1100968).

This update fix CVE-2018-10895 **[0]** and a few minor bugs.

**[0]** : Due to a CSRF vulnerability affecting the `qute://settings` page, it was possible for websites to modify qutebrowser settings. Via settings like `editor.command`, this possibly **allowed websites to execute arbitrary code**. 

----

This version fix compatibility issues with qtwebengine 5.11.x, add support for page printing, tab muting, third-party cookie blocking and has the web inspector 'enabled' (does not require `--enable-webengine-inspector`) by default. It also ships a few bugfixes and changes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

qutebrowser team reports :

Due to a CSRF vulnerability affecting the qute://settings page, it was possible for websites to modify qutebrowser settings. Via settings like editor.command, this possibly allowed websites to execute arbitrary code.

ID	Name	Product	Family	Severity
421960	SCA: security update for qutebrowser (GHSA-wgmx-52ph-qqcw)	Tenable Cloud Security	SCA Checks	high
421960	SCA: security update for qutebrowser (GHSA-wgmx-52ph-qqcw)	Tenable Self-Hosted Container Security	SCA Checks	high
123232	openSUSE Security Update : qutebrowser (openSUSE-2019-545)	Nessus	SuSE Local Security Checks	high
120468	Fedora 28 : qutebrowser (2018-61dbd4a787)	Nessus	Fedora Local Security Checks	high
111427	openSUSE Security Update : qutebrowser (openSUSE-2018-775)	Nessus	SuSE Local Security Checks	high
111237	Fedora 27 : qutebrowser (2018-35325c9faf)	Nessus	Fedora Local Security Checks	high
111090	FreeBSD : qutebrowser -- Remote code execution due to CSRF (bd6cf187-8710-11e8-833d-18a6f7016652)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-10895

high

Tenable Plugins

high

high

high

high

high

high

high