Lucene search

K
ubuntuUbuntuUSN-3058-1
HistorySep 14, 2016 - 12:00 a.m.

Oxide vulnerabilities

2016-09-1400:00:00
ubuntu.com
39

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.026 Low

EPSS

Percentile

90.1%

Releases

  • Ubuntu 16.04 ESM
  • Ubuntu 14.04 ESM

Packages

  • oxide-qt - Web browser engine for Qt (QML plugin)

Details

An issue was discovered in Blink involving the provisional URL for an
initially empty document. An attacker could potentially exploit this to
spoof the currently displayed URL. (CVE-2016-5141)

A use-after-free was discovered in the WebCrypto implementation in Blink.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code. (CVE-2016-5142)

It was discovered that the devtools subsystem in Blink mishandles various
parameters. An attacker could exploit this to bypass intended access
restrictions. (CVE-2016-5143, CVE-2016-5144)

It was discovered that Blink does not ensure that a taint property is
preserved after a structure-clone operation on an ImageBitmap object
derived from a cross-origin image. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
bypass same origin restrictions. (CVE-2016-5145)

Multiple security issues were discovered in Chromium. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to read uninitialized memory, cause a denial
of service via application crash, or execute arbitrary code.
(CVE-2016-5146, CVE-2016-5167)

It was discovered that Blink mishandles deferred page loads. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2016-5147)

An issue was discovered in Blink related to widget updates. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2016-5148)

A use-after-free was discovered in Blink. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service via application crash, or execute
arbitrary code. (CVE-2016-5150)

A use-after-free was discovered in Blink. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service via application crash, or execute
arbitrary code. (CVE-2016-5153)

It was discovered that Chromium does not correctly validate access to the
initial document. An attacker could potentially exploit this to spoof the
currently displayed URL. (CVE-2016-5155)

A use-after-free was discovered in the event bindings in Blink. If a user
were tricked in to opening a specially crafted website, an attacker could
potentially exploit this to cause a denial of service via application
crash, or execute arbitrary code. (CVE-2016-5156)

A type confusion bug was discovered in Blink. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service via application crash, or execute
arbitrary code. (CVE-2016-5161)

An issue was discovered with the devtools implementation. An attacker
could potentially exploit this to conduct cross-site scripting (XSS)
attacks. (CVE-2016-5164)

An issue was discovered with the devtools implementation. An attacker
could potentially exploit this to conduct cross-site scripting (XSS)
attacks. (CVE-2016-5165)

OSVersionArchitecturePackageVersionFilename
Ubuntu16.04noarchliboxideqtcore0< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchliboxideqt-qmlplugin< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchliboxideqtcore-dev< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchliboxideqtcore0-dbgsym< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchliboxideqtquick-dev< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchliboxideqtquick0< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchoxideqt-codecs< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchoxideqt-codecs-dbgsym< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchoxideqt-codecs-extra< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Ubuntu16.04noarchoxideqt-codecs-extra-dbgsym< 1.17.7-0ubuntu0.16.04.1UNKNOWN
Rows per page:
1-10 of 251

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.026 Low

EPSS

Percentile

90.1%