Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 15.10: USN-2825-1 Critical: Oxide Browser Application Crash

ubuntu
Calendar Grey December 10, 2015
Scroller Ubuntu
Numerous vulnerabilities in the Oxide web rendering engine have been resolved to avert possible security breaches and software failures.
Several security issues were fixed in Oxide.

Summary

Several security issues were fixed in Oxide.

Software Description:

- oxide-qt: Web browser engine library for Qt (QML plugin)

Details:

Multiple use-after-free bugs were discovered in the application cache

implementation in Chromium. If a user were tricked in to opening a

specially crafted website, an attacker could potentially exploit these to

cause a denial of service via application crash, or execute arbitrary code

with the privileges of the user invoking the program. (CVE-2015-6765,

CVE-2015-6766, CVE-2015-6767)

Several security issues were discovered in the DOM implementation in

Chromium. If a user were tricked in to opening a specially crafted

website, an attacker could potentially exploit these to bypass same

origin restrictions. (CVE-2015-6768, CVE-2015-6770)

A security issue was discovered in the provisional-load commit

implementation in Chromium. If a user were tricked in to opening a

specially crafted website, an attacker could potentially explo...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu application crash Oxide

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  liboxideqtcore0                 1.11.3-0ubuntu0.15.10.1

Ubuntu 15.04:
  liboxideqtcore0                 1.11.3-0ubuntu0.15.04.1

Ubuntu 14.04 LTS:
  liboxideqtcore0                 1.11.3-0ubuntu0.14.04.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2825-1

CVE-2015-6765, CVE-2015-6766, CVE-2015-6767, CVE-2015-6768,

CVE-2015-6769, CVE-2015-6770, CVE-2015-6771, CVE-2015-6772,

CVE-2015-6773, CVE-2015-6777, CVE-2015-6782, CVE-2015-6784,

CVE-2015-6785, CVE-2015-6786, CVE-2015-6787, CVE-2015-8478

Severity
critical
Lowest
Low
Medium
High
Critical

December 10, 2015

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu application crash Oxide

Package Information

https://launchpad.net/ubuntu/+source/oxide-qt/1.11.3-0ubuntu0.15.10.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.11.3-0ubuntu0.15.04.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.11.3-0ubuntu0.14.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.