CVE-2017-6503

NameCVE-2017-6503
DescriptionWebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-897-1
Debian Bugs856977

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qbittorrent (PTS)jessie3.1.10-1vulnerable
stretch (security), stretch (lts), stretch3.3.7-3+deb9u1fixed
buster (security), buster, buster (lts)4.1.5-1+deb10u1fixed
bullseye4.2.5-0.1fixed
bookworm4.5.2-3+deb12u1fixed
trixie5.0.1-1fixed
sid5.0.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qbittorrentsourcewheezy2.9.8-1+deb7u1DLA-897-1
qbittorrentsource(unstable)3.3.7-3low856977

Notes

[jessie] - qbittorrent <no-dsa> (Minor issue)
https://github.com/qbittorrent/qBittorrent/commit/6ca3e4f094da0a0017cb2d483ec1db6176bb0b16
Fixed upstream in 3.3.11

Search for package or bug name: Reporting problems