what you don't know can hurt you

Ubuntu Security Notice USN-2920-1

Ubuntu Security Notice USN-2920-1
Posted Mar 11, 2016
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2920-1 - It was discovered that the ContainerNode::parserRemoveChild function in Blink mishandled widget updates in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. It was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun function in Chromium mishandled nested message loops. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. Various other issues were also addressed.

tags | advisory
systems | linux, ubuntu
advisories | CVE-2016-1630, CVE-2016-1631, CVE-2016-1633, CVE-2016-1634, CVE-2016-1636, CVE-2016-1637, CVE-2016-1641, CVE-2016-1642, CVE-2016-1643, CVE-2016-1644, CVE-2016-2843, CVE-2016-2844, CVE-2016-2845
MD5 | 513bd1415107ebd18f27b168e93115f3

Ubuntu Security Notice USN-2920-1

Change Mirror Download
============================================================================
Ubuntu Security Notice USN-2920-1
March 10, 2016

oxide-qt vulnerabilities
============================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 15.10
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Oxide.

Software Description:
- oxide-qt: Web browser engine for Qt (QML plugin)

Details:

It was discovered that the ContainerNode::parserRemoveChild function in
Blink mishandled widget updates in some circumstances. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2016-1630)

It was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun
function in Chromium mishandled nested message loops. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit this to bypass same-origin restrictions.
(CVE-2016-1631)

Multiple use-after-frees were discovered in Blink. If a user were tricked
in to opening a specially crafted website, an attacker could potentially
exploit these to cause a denial of service via renderer crash or execute
arbitrary code with the privileges of the sandboxed render process.
(CVE-2016-1633, CVE-2016-1634, CVE-2016-1644)

It was discovered that the PendingScript::notifyFinished function in
Blink relied on memory-cache information about integrity-check occurrences
instead of integrity-check successes. If a user were tricked in to opening
a specially crafted website, an attacker could potentially exploit this to
bypass Subresource Integrity (SRI) protections. (CVE-2016-1636)

It was discovered that the SkATan2_255 function in Skia mishandled
arctangent calculations. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to obtain
sensitive information. (CVE-2016-1637)

A use-after-free was discovered in Chromium. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service via application crash, or execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2016-1641)

Multiple security issues were discovered in Chromium. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to read uninitialized memory, cause a denial
of service via application crash or execute arbitrary code with the
privileges of the user invoking the program. (CVE-2016-1642)

A type-confusion bug was discovered in Blink. If a user were tricked in
to opening a specially crafted website, an attacker could potentially
exploit this to cause a denial of service via renderer crash or execute
arbitrary code with the privileges of the sandboxed render process.
(CVE-2016-1643)

Multiple security issues were discovered in V8. If a user were tricked
in to opening a specially crafted website, an attacker could potentially
exploit these to read uninitialized memory, cause a denial of service via
renderer crash or execute arbitrary code with the privileges of the
sandboxed render process. (CVE-2016-2843)

An invalid cast was discovered in Blink. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service via renderer crash or execute arbitrary
code with the privileges of the sandboxed render process. (CVE-2016-2844)

It was discovered that the Content Security Policy (CSP) implementation in
Blink did not ignore a URL's path component in the case of a ServiceWorker
fetch. If a user were tricked in to opening a specially crafted website,
an attacker could potentially exploit this to obtain sensitive
information. (CVE-2016-2845)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
liboxideqtcore0 1.13.6-0ubuntu0.15.10.1

Ubuntu 14.04 LTS:
liboxideqtcore0 1.13.6-0ubuntu0.14.04.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2920-1
CVE-2016-1630, CVE-2016-1631, CVE-2016-1633, CVE-2016-1634,
CVE-2016-1636, CVE-2016-1637, CVE-2016-1641, CVE-2016-1642,
CVE-2016-1643, CVE-2016-1644, CVE-2016-2843, CVE-2016-2844,
CVE-2016-2845

Package Information:
https://launchpad.net/ubuntu/+source/oxide-qt/1.13.6-0ubuntu0.15.10.1
https://launchpad.net/ubuntu/+source/oxide-qt/1.13.6-0ubuntu0.14.04.1
Login or Register to add favorites

File Archive:

June 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    10 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    0 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    0 Files
  • 7
    Jun 7th
    0 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    0 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close