Updated cantata and qutebrowser packages has been released for Arch Linux:

ASA-201806-12: cantata: multiple issues
The package cantata before version 2.3.1-2 is vulnerable to multiple issues including access restriction bypass and privilege escalation.

ASA-201806-13: qutebrowser: cross-site scripting
The package qutebrowser before version 1.3.3-1 is vulnerable to cross-site scripting.

ASA-201806-12: cantata: multiple issues

Arch Linux Security Advisory ASA-201806-12
==========================================

Severity: High
Date : 2018-06-20
CVE-ID : CVE-2018-12559 CVE-2018-12560 CVE-2018-12561 CVE-2018-12562
Package : cantata
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-721

Summary
=======

The package cantata before version 2.3.1-2 is vulnerable to multiple
issues including access restriction bypass and privilege escalation.

Resolution
==========

Upgrade to 2.3.1-2.

# pacman -Syu "cantata>=2.3.1-2"

The problems have been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

- CVE-2018-12559 (privilege escalation)

An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is
insufficient. A regular user can consequently mount a CIFS filesystem
anywhere (e.g., outside of the /home directory tree) by passing
directory traversal sequences such as a home/../usr substring.

- CVE-2018-12560 (access restriction bypass)

An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. Arbitrary unmounts can be performed by regular users via
directory traversal sequences such as a home/../sys/kernel substring.

- CVE-2018-12561 (access restriction bypass)

An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. A regular user can inject additional mount options such
as file_mode= by manipulating (for example) the domain parameter of the
samba URL.

- CVE-2018-12562 (access restriction bypass)

An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell
to forward the arguments to the actual mount.cifs binary. The shell
evaluates wildcards (such as in an injected string:/home/../tmp/*
string).

Impact
======

An unprivileged user is able to mount remote samba shares, enabling
arbitrary filesystem access and privileged escalation.

References
==========

http://www.openwall.com/lists/oss-security/2018/06/18/1
https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3
http://www.openwall.com/lists/oss-security/2018/06/18/1
https://security.archlinux.org/CVE-2018-12559
https://security.archlinux.org/CVE-2018-12560
https://security.archlinux.org/CVE-2018-12561
https://security.archlinux.org/CVE-2018-12562

ASA-201806-13: qutebrowser: cross-site scripting

Arch Linux Security Advisory ASA-201806-13
==========================================

Severity: Medium
Date : 2018-06-26
CVE-ID : CVE-2018-1000559
Package : qutebrowser
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-724

Summary
=======

The package qutebrowser before version 1.3.3-1 is vulnerable to cross-
site scripting.

Resolution
==========

Upgrade to 1.3.3-1.

# pacman -Syu "qutebrowser>=1.3.3-1"

The problem has been fixed upstream in version 1.3.3.

Workaround
==========

None.

Description
===========

qutebrowser before 1.3.3 contains a Cross Site Scripting (XSS)
vulnerability that can result in a website stealing the user's browsing
history. This attack can be exploitable by tricking the victim into
opening a page with a specially crafted attribute, and then
opening the qute://history site via the :history command.

Impact
======

A remote attacker is able to steal the browser history with a specially
crafted web page title.

References
==========

https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7
https://github.com/qutebrowser/qutebrowser/issues/4011
https://security.archlinux.org/CVE-2018-1000559