This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============6111997960625707090== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="xvQBhxvQ19AsKbC6MHs6wuIFinNmVCeb5"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --xvQBhxvQ19AsKbC6MHs6wuIFinNmVCeb5 Content-Type: multipart/mixed; boundary="VcLsl8C6S4EMAErQQbSsbLRM1Q4n6Csja" From: Chris Coulson <chris.coulson@canonical.com> Reply-To: Ubuntu Security <security@ubuntu.com> To: ubuntu-security-announce@lists.ubuntu.com Message-ID: <b4b05d90-5aa5-5565-3e55-6185fc3ae9a1@canonical.com> Subject: [USN-3113-1] Oxide vulnerabilities
--VcLsl8C6S4EMAErQQbSsbLRM1Q4n6Csja Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable Content-Language: en-US
========================================================================== Ubuntu Security Notice USN-3113-1 November 02, 2016
oxide-qt vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Oxide.
Software Description: - oxide-qt: Web browser engine for Qt (QML plugin)
Details:
It was discovered that a long running unload handler could cause an incognito profile to be reused in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-1586)
Multiple security vulnerabilities were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to conduct cross-site scripting (XSS) attacks, spoof an application's URL bar, obtain sensitive information, cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5181, CVE-2016-5182, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5189, CVE-2016-5192, CVE-2016-5194)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.10: liboxideqtcore0 1.18.3-0ubuntu0.16.10.1
Ubuntu 16.04 LTS: liboxideqtcore0 1.18.3-0ubuntu0.16.04.1
Ubuntu 14.04 LTS: liboxideqtcore0 1.18.3-0ubuntu0.14.04.1
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-3113-1 CVE-2016-1586, CVE-2016-5181, CVE-2016-5182, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5189, CVE-2016-5192, CVE-2016-5194
Package Information: https://launchpad.net/ubuntu/+source/oxide-qt/1.18.3-0ubuntu0.16.10.1 https://launchpad.net/ubuntu/+source/oxide-qt/1.18.3-0ubuntu0.16.04.1 https://launchpad.net/ubuntu/+source/oxide-qt/1.18.3-0ubuntu0.14.04.1
--VcLsl8C6S4EMAErQQbSsbLRM1Q4n6Csja--
--xvQBhxvQ19AsKbC6MHs6wuIFinNmVCeb5 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2
iQEcBAEBCAAGBQJYGgHyAAoJEGEfvezVlG4PLwMIAICagvm6SOB8rnxRczUTF8Oc dI5N2y6ZnGJt96/dIguCGak7W2ft5WXPTwH1+H94EfBcmXFBwu7HgJTpQYHiknLB gPo3Vz6Dw0lTzy2suGd/RR3qPg2CgKzVN1osVZa6DxY5BTzkanefA2ThnwQ5PMOD lvM195RPAQSyNAVJdhbp7kroBvNFG1XNTmwRr1Lhu1MtBd/ExE7HbMjXjkNIq27+ MvMXrA2gBkGwg/vyrkmHhydaHOKT2TB5HbU5rVEGHcVKO54684ljqS5pLWESf7Ut tPq++SDjh1bEN7OMcBNsmJh0bREVBkT8ThXENH2g/PqeC6wNGWXkky3m+k8D2WE= =3Xu9 -----END PGP SIGNATURE-----
--xvQBhxvQ19AsKbC6MHs6wuIFinNmVCeb5--
--===============6111997960625707090== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============6111997960625707090==--
|