CVE-2018-0499

Publication date 2 July 2018

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.1 · Medium

Score breakdown

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().

Read the notes from the security team

Status

Package Ubuntu Release Status
xapian-core 18.04 LTS bionic
Fixed 1.4.5-1ubuntu0.1
17.10 artful
Fixed 1.4.4-2ubuntu0.1
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Notes

leosilva

versions precise/esm, trusty and xenial are not affected second upstream msg "1.2.x doesn't have this method, so isn't vulnerable".

Severity score breakdown

Parameter Value
Base score 6.1 · Medium
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Scope Changed
Confidentiality Low
Integrity impact Low
Availability impact None
Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N