Ubuntu 16.04 LTS USN-3041-1 Critical: Oxide Denial Of Service Threat

Several security issues were fixed in Oxide.

Software Description:

- oxide-qt: Web browser engine for Qt (QML plugin)

Details:

Multiple security issues were discovered in Chromium. If a user were

tricked in to opening a specially crafted website, an attacker could

potentially exploit these to read uninitialized memory, cause a denial

of service (application crash) or execute arbitrary code. (CVE-2016-1705)

It was discovered that the PPAPI implementation does not validate the

origin of IPC messages to the plugin broker process. A remote attacker

could potentially exploit this to bypass sandbox protection mechanisms.

(CVE-2016-1706)

It was discovered that Blink does not prevent window creation by a

deferred frame. A remote attacker could potentially exploit this to bypass

same origin restrictions. (CVE-2016-1710)

It was discovered that Blink does not disable frame navigation during a

detach operation on a DocumentLoader object. A remote attacker could

po...