USN-2556-1

Dashboard / Vulnerabilities / USN-2556-1

USN-2556-1

Summary: oxide-qt vulnerabilities

Details: It was discovered that Chromium did not properly handle the interaction of IPC, the gamepad API and V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1233) A buffer overflow was discovered in the GPU service. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2015-1234) It was discovered that Oxide did not correctly manage the lifetime of BrowserContext, resulting in a potential use-after-free in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1317)

References: https://ubuntu.com/security/notices/USN-2556-1, https://ubuntu.com/security/CVE-2015-1233, https://ubuntu.com/security/CVE-2015-1234, https://ubuntu.com/security/CVE-2015-1317, https://launchpad.net/bugs/1431484