Search for packages
| purl | pkg:deb/ubuntu/oxide-qt@1.18.3-0ubuntu0.14.04.1 |
| Next non-vulnerable version | 1.21.5-0ubuntu0.14.04.1 |
| Latest non-vulnerable version | 1.21.5-0ubuntu0.16.04.1 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-15et-tcvg-aaab
Aliases: CVE-2016-5199 |
An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 45 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-37qj-e7y3-aaab
Aliases: CVE-2016-5213 |
A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-3dw3-1sjv-aaag
Aliases: CVE-2016-5202 |
browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy. |
Affected by 45 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-3fxs-63ze-aaam
Aliases: CVE-2017-5030 |
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-561u-gsq3-aaab
Aliases: CVE-2016-9651 |
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-63em-f5aj-aaad
Aliases: CVE-2017-5040 |
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-8999-y7he-aaab
Aliases: CVE-2016-5219 |
A heap use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-9r59-cy8b-aaaa
Aliases: CVE-2017-5006 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-9tv6-tvj9-aaah
Aliases: CVE-2017-5017 |
Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extract image fragments on systems with GeForce 8600M graphics chips via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-9wkw-j45r-aaar
Aliases: CVE-2017-5022 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-9y6t-uz46-aaad
Aliases: CVE-2017-5029 GHSA-pf6m-fxpq-fg8v |
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-a968-v7d1-aaah
Aliases: CVE-2017-5035 |
Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-b4ay-xbyg-aaaa
Aliases: CVE-2017-5024 |
FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-b6gm-xpgj-aaag
Aliases: CVE-2017-5025 |
FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-brb9-3xj9-aaah
Aliases: CVE-2017-5014 |
Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-bzx2-njp3-aaac
Aliases: CVE-2017-5010 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-c5t4-3azw-aaah
Aliases: CVE-2016-9652 |
Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-cjt2-72uw-aaaf
Aliases: CVE-2016-5207 |
In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code execution via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-cmsz-uwmb-aaak
Aliases: CVE-2016-5198 |
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page. |
Affected by 45 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-dc82-nm96-aaac
Aliases: CVE-2017-5031 |
A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-e5sn-g1vc-aaan
Aliases: CVE-2017-5041 |
Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-eg6q-kekn-aaas
Aliases: CVE-2015-3395 |
The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-erag-eyn2-aaah
Aliases: CVE-2016-9650 |
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attacker to bypass a no-referrer policy via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-f84k-swdb-aaan
Aliases: CVE-2016-5209 |
Bad casting in bitmap manipulation in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-gkum-epbx-aaaq
Aliases: CVE-2017-5046 |
V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-kp5n-qnpm-aaaq
Aliases: CVE-2016-5221 |
Type confusion in libGLESv2 in ANGLE in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android possibly allowed a remote attacker to bypass buffer validation via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-mr8h-b2uz-aaab
Aliases: CVE-2016-5204 |
Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-mt8f-pyvq-aaaq
Aliases: CVE-2017-5009 |
WebRTC in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds checking, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-nevx-9gyg-aaad
Aliases: CVE-2016-5215 |
A use after free in webaudio in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-nkf5-xx9k-aaah
Aliases: CVE-2016-5200 |
V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 45 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-p817-jw6u-aaas
Aliases: CVE-2016-5224 |
A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-pe2a-7rtn-aaaq
Aliases: CVE-2017-5019 |
A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-qgjz-nen9-aaan
Aliases: CVE-2016-5225 |
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-rkcb-qyc8-aaaa
Aliases: CVE-2017-5045 |
XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-s5ta-1p4j-aaad
Aliases: CVE-2016-5212 |
Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-s7zr-aw7h-aaan
Aliases: CVE-2017-5044 |
Heap buffer overflow in filter processing in Skia in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-sgnc-347g-aaah
Aliases: CVE-2017-5023 |
Type confusion in Histogram in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit a near null dereference via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-spvv-jn57-aaam
Aliases: CVE-2016-5205 |
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-syhs-jdj3-aaas
Aliases: CVE-2017-5008 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during the invocation of a private script method, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-t42a-hd1c-aaaa
Aliases: CVE-2016-5222 |
Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-t8gt-2hus-aaaa
Aliases: CVE-2017-5037 |
An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-tpeh-7gcc-aaaf
Aliases: CVE-2017-5026 |
Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts on a page they don't control via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-tpn3-2brd-aaad
Aliases: CVE-2017-5033 |
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-tznb-pcuf-aaar
Aliases: CVE-2016-5226 |
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, which allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-ufg7-d65p-aaak
Aliases: CVE-2017-5027 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content security policy, which allowed a remote attacker to bypass content security policy via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-vd5v-psbw-aaaq
Aliases: CVE-2016-5208 |
Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 27 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-wbn4-ykqu-aaak
Aliases: CVE-2017-5007 |
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing a page, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-wdpa-yxc1-aaaa
Aliases: CVE-2017-5012 |
A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-xpyj-uw54-aaam
Aliases: CVE-2017-5011 |
Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page. |
Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-3ssp-uvwm-aaab | Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files. |
CVE-2016-5186
|
| VCID-dspz-cq4b-aaah | Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages. |
CVE-2016-5181
|
| VCID-ewf2-44r6-aaag | Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages. |
CVE-2016-5188
|
| VCID-f6fe-jwwu-aaaa | Unspecified vulnerabilities in Google Chrome before 54.0.2840.59. |
CVE-2016-5194
|
| VCID-ggky-nw5w-aaar | Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(), which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. |
CVE-2016-5185
|
| VCID-kc87-8y6z-aaaq | Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. |
CVE-2016-5187
|
| VCID-n2f3-tvmz-aaak | Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages. |
CVE-2016-5192
|
| VCID-snp1-1vxd-aaaa | A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3. |
CVE-2016-1586
|
| VCID-wuby-sjvn-aaah | Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages. |
CVE-2016-5182
|
| VCID-x628-g9qg-aaam | Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. |
CVE-2016-5189
|
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|