USN-2920-1 (UBUNTU-CVE-2016-1630)

Vulnerability from osv_ubuntu – Published: 2016-03-10 17:22 – Updated: 2026-04-22 07:36 – Source website
VLAI
Summary
oxide-qt vulnerabilities
Details

It was discovered that the ContainerNode::parserRemoveChild function in Blink mishandled widget updates in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1630)

It was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun function in Chromium mishandled nested message loops. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1631)

Multiple use-after-frees were discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1633, CVE-2016-1634, CVE-2016-1644)

It was discovered that the PendingScript::notifyFinished function in Blink relied on memory-cache information about integrity-check occurrences instead of integrity-check successes. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass Subresource Integrity (SRI) protections. (CVE-2016-1636)

It was discovered that the SkATan2_255 function in Skia mishandled arctangent calculations. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-1637)

A use-after-free was discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2016-1641)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2016-1642)

A type-confusion bug was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1643)

Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-2843)

An invalid cast was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-2844)

It was discovered that the Content Security Policy (CSP) implementation in Blink did not ignore a URL's path component in the case of a ServiceWorker fetch. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-2845)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-1630",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1631",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1633",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1634",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1636",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1637",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1641",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1642",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1643",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1644",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-2843",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-2844",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-2845",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "liboxideqt-qmlplugin",
            "binary_version": "1.13.6-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "liboxideqtcore0",
            "binary_version": "1.13.6-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "liboxideqtquick0",
            "binary_version": "1.13.6-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "oxideqmlscene",
            "binary_version": "1.13.6-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "oxideqt-chromedriver",
            "binary_version": "1.13.6-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "oxideqt-codecs",
            "binary_version": "1.13.6-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "oxideqt-codecs-extra",
            "binary_version": "1.13.6-0ubuntu0.14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "oxide-qt",
        "purl": "pkg:deb/ubuntu/oxide-qt@1.13.6-0ubuntu0.14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.6-0ubuntu0.14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0~bzr437-0ubuntu1",
        "1.0.0~bzr452-0ubuntu1",
        "1.0.0~bzr475-0ubuntu1",
        "1.0.0~bzr490-0ubuntu1",
        "1.0.0~bzr501-0ubuntu1",
        "1.0.0~bzr501-0ubuntu2",
        "1.0.4-0ubuntu0.14.04.1",
        "1.0.5-0ubuntu0.14.04.1",
        "1.1.2-0ubuntu0.14.04.1",
        "1.2.5-0ubuntu0.14.04.1",
        "1.3.4-0ubuntu0.14.04.1",
        "1.4.2-0ubuntu0.14.04.1",
        "1.4.3-0ubuntu0.14.04.1",
        "1.5.5-0ubuntu0.14.04.3",
        "1.5.6-0ubuntu0.14.04.2",
        "1.6.5-0ubuntu0.14.04.1",
        "1.6.6-0ubuntu0.14.04.1",
        "1.7.8-0ubuntu0.14.04.1",
        "1.7.9-0ubuntu0.14.04.1",
        "1.8.4-0ubuntu0.14.04.2",
        "1.9.1-0ubuntu0.14.04.2",
        "1.9.5-0ubuntu0.14.04.1",
        "1.10.3-0ubuntu0.14.04.1",
        "1.11.3-0ubuntu0.14.04.1",
        "1.11.4-0ubuntu0.14.04.1",
        "1.12.5-0ubuntu0.14.04.1",
        "1.12.6-0ubuntu0.14.04.1",
        "1.12.7-0ubuntu0.14.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that the ContainerNode::parserRemoveChild function in\nBlink mishandled widget updates in some circumstances. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit this to bypass same-origin restrictions.\n(CVE-2016-1630)\n\nIt was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun \nfunction in Chromium mishandled nested message loops. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit this to bypass same-origin restrictions.\n(CVE-2016-1631)\n\nMultiple use-after-frees were discovered in Blink. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to cause a denial of service via renderer crash or execute\narbitrary code with the privileges of the sandboxed render process.\n(CVE-2016-1633, CVE-2016-1634, CVE-2016-1644)\n\nIt was discovered that the PendingScript::notifyFinished function in\nBlink relied on memory-cache information about integrity-check occurrences\ninstead of integrity-check successes. If a user were tricked in to opening\na specially crafted website, an attacker could potentially exploit this to\nbypass Subresource Integrity (SRI) protections. (CVE-2016-1636)\n\nIt was discovered that the SkATan2_255 function in Skia mishandled\narctangent calculations. If a user were tricked in to opening a specially\ncrafted website, an attacker could potentially exploit this to obtain\nsensitive information. (CVE-2016-1637)\n\nA use-after-free was discovered in Chromium. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthis to cause a denial of service via application crash, or execute\narbitrary code with the privileges of the user invoking the program.\n(CVE-2016-1641)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code with the\nprivileges of the user invoking the program. (CVE-2016-1642)\n\nA type-confusion bug was discovered in Blink. If a user were tricked in\nto opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash or execute\narbitrary code with the privileges of the sandboxed render process.\n(CVE-2016-1643)\n\nMultiple security issues were discovered in V8. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to read uninitialized memory, cause a denial of service via\nrenderer crash or execute arbitrary code with the privileges of the\nsandboxed render process. (CVE-2016-2843)\n\nAn invalid cast was discovered in Blink. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthis to cause a denial of service via renderer crash or execute arbitrary\ncode with the privileges of the sandboxed render process. (CVE-2016-2844)\n\nIt was discovered that the Content Security Policy (CSP) implementation in\nBlink did not ignore a URL\u0027s path component in the case of a ServiceWorker\nfetch. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit this to obtain sensitive\ninformation. (CVE-2016-2845)\n",
  "id": "USN-2920-1",
  "modified": "2026-04-22T07:36:33Z",
  "published": "2016-03-10T17:22:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2920-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1630"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1631"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1633"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1634"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1636"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1637"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1641"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1642"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1643"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1644"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-2843"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-2844"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-2845"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "oxide-qt vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-1630",
    "UBUNTU-CVE-2016-1631",
    "UBUNTU-CVE-2016-1633",
    "UBUNTU-CVE-2016-1634",
    "UBUNTU-CVE-2016-1636",
    "UBUNTU-CVE-2016-1637",
    "UBUNTU-CVE-2016-1641",
    "UBUNTU-CVE-2016-1642",
    "UBUNTU-CVE-2016-1643",
    "UBUNTU-CVE-2016-1644",
    "UBUNTU-CVE-2016-2843",
    "UBUNTU-CVE-2016-2844",
    "UBUNTU-CVE-2016-2845"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.