Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 531
Alerts This Week
Warning Icon 1 531

Ubuntu 15.04 LTS USN-2652-1 Critical: Oxide Browser Threats

ubuntu
Calendar Grey June 30, 2015
Scroller Ubuntu Esm H88
Ubuntu Security Notice USN-2653-1 reveals significant vulnerabilities in the Oxide web browser that threaten user privacy.
Several security issues were fixed in Oxide.

Summary

Several security issues were fixed in Oxide.

Software Description:

- oxide-qt: Web browser engine library for Qt (QML plugin)

Details:

It was discovered that Chromium did not properly consider the scheme when

determining whether a URL is associated with a WebUI SiteInstance. If a

user were tricked in to opening a specially crafted website, an attacker

could potentially exploit this to bypass security restrictions.

(CVE-2015-1266)

It was discovered that Blink did not properly restrict the creation

context during creation of a DOM wrapper. If a user were tricked in to

opening a specially crafted website, an attacker could potentially exploit

this to bypass same-origin restrictions. (CVE-2015-1267, CVE-2015-1268)

It was discovered that Chromium did not properly canonicalize DNS hostnames

before comparing to HSTS or HPKP preload entries. An attacker could

potentially exploit this to bypass intended access restrictions.

(CVE-2015-1269)

Topics%20covered

Topics Covered

security advisory critical issue Ubuntu web browser bypass access restriction Oxide

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  liboxideqtcore0                 1.7.9-0ubuntu0.15.04.1

Ubuntu 14.10:
  liboxideqtcore0                 1.7.9-0ubuntu0.14.10.1

Ubuntu 14.04 LTS:
  liboxideqtcore0                 1.7.9-0ubuntu0.14.04.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2652-1

CVE-2015-1266, CVE-2015-1267, CVE-2015-1268, CVE-2015-1269

Severity
critical
Lowest
Low
Medium
High
Critical

June 30, 2015

Topics%20covered

Topics Covered

security advisory critical issue Ubuntu web browser bypass access restriction Oxide

Package Information

https://launchpad.net/ubuntu/+source/oxide-qt/1.7.9-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.7.9-0ubuntu0.14.10.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.7.9-0ubuntu0.14.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.