Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

Ubuntu 16.04: USN-2955-1 Critical Oxide Web Engine DoS Threats

ubuntu
Calendar Grey April 27, 2016
Scroller Ubuntu
Ubuntu has addressed multiple vulnerabilities in Oxide to prevent potential Denial of Service (DoS) attacks and block unauthorized code execution via malicious web pages
Several security issues were fixed in Oxide.

Summary

Several security issues were fixed in Oxide.

Software Description:

- oxide-qt: Web browser engine for Qt (QML plugin)

Details:

A use-after-free was discovered when responding synchronously to

permission requests. An attacker could potentially exploit this to cause

a denial of service via application crash, or execute arbitrary code with

the privileges of the user invoking the program. (CVE-2016-1578)

An out-of-bounds read was discovered in V8. If a user were tricked in to

opening a specially crafted website, an attacker could potentially exploit

this to cause a denial of service via renderer crash. (CVE-2016-1646)

A use-after-free was discovered in the navigation implementation in

Chromium in some circumstances. If a user were tricked in to opening a

specially crafted website, an attacker could potentially exploit this to

cause a denial of service via application crash, or execute arbitrary code

with the privileges of the user invoking the program. (CVE-20...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical DoS Ubuntu application crash Oxide web engine

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  liboxideqtcore0                 1.14.7-0ubuntu1

Ubuntu 15.10:
  liboxideqtcore0                 1.14.7-0ubuntu0.15.10.1

Ubuntu 14.04 LTS:
  liboxideqtcore0                 1.14.7-0ubuntu0.14.04.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2955-1

CVE-2016-1578, CVE-2016-1646, CVE-2016-1647, CVE-2016-1649,

CVE-2016-1653, CVE-2016-1654, CVE-2016-1655, CVE-2016-1659,

CVE-2016-3679,

Severity
critical
Lowest
Low
Medium
High
Critical

April 27, 2016

Topics%20covered

Topics Covered

security advisory critical DoS Ubuntu application crash Oxide web engine

Package Information

https://launchpad.net/ubuntu/+source/oxide-qt/1.14.7-0ubuntu1
https://launchpad.net/ubuntu/+source/oxide-qt/1.14.7-0ubuntu0.15.10.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.14.7-0ubuntu0.14.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.