Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 15.10 USN-2920-1: Serious Security Issues in Oxide Detected

ubuntu
Calendar Grey March 10, 2016
Scroller Ubuntu
Address several Oxide vulnerabilities in Ubuntu to mitigate potential threats and uphold system protection and integrity.
Several security issues were fixed in Oxide.

Summary

Several security issues were fixed in Oxide.

Software Description:

- oxide-qt: Web browser engine for Qt (QML plugin)

Details:

It was discovered that the ContainerNode::parserRemoveChild function in

Blink mishandled widget updates in some circumstances. If a user were

tricked in to opening a specially crafted website, an attacker could

potentially exploit this to bypass same-origin restrictions.

(CVE-2016-1630)

It was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun

function in Chromium mishandled nested message loops. If a user were

tricked in to opening a specially crafted website, an attacker could

potentially exploit this to bypass same-origin restrictions.

(CVE-2016-1631)

Multiple use-after-frees were discovered in Blink. If a user were tricked

in to opening a specially crafted website, an attacker could potentially

exploit these to cause a denial of service via renderer crash or execute

arbitrary code with the privileges of the sandboxe...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service update code execution Ubuntu browser engine Oxide

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  liboxideqtcore0                 1.13.6-0ubuntu0.15.10.1

Ubuntu 14.04 LTS:
  liboxideqtcore0                 1.13.6-0ubuntu0.14.04.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2920-1

CVE-2016-1630, CVE-2016-1631, CVE-2016-1633, CVE-2016-1634,

CVE-2016-1636, CVE-2016-1637, CVE-2016-1641, CVE-2016-1642,

CVE-2016-1643, CVE-2016-1644, CVE-2016-2843, CVE-2016-2844,

CVE-2016-2845

Severity
important
Lowest
Low
Medium
High
Critical

March 10, 2016

Topics%20covered

Topics Covered

security advisory denial of service update code execution Ubuntu browser engine Oxide

Package Information

https://launchpad.net/ubuntu/+source/oxide-qt/1.13.6-0ubuntu0.15.10.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.13.6-0ubuntu0.14.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.