CVE-2018-0499

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-02 · updated 2026-06-17
Weakness: CWE-79

Description

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet().

Affected products

Canonical Ubuntu Linux: 17.10, 18.04
xapian-core: before 1.4.6 — fixed in 1.4.6

How to fix

Upgrade to a fixed version: xapian-core 1.4.6. Check the vendor advisory for mitigations.

References

https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html
https://trac.xapian.org/wiki/SecurityFixes/2018-07-02
https://usn.ubuntu.com/3709-1/
https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html
https://trac.xapian.org/wiki/SecurityFixes/2018-07-02
https://usn.ubuntu.com/3709-1/

Get alerted when CVE-2018-0499 or the next vulnerability affects your stack