Skip to content
OpenAdvisories
Unscored USN-2652-1 4 CVEs

oxide-qt vulnerabilities

Published Jun 30, 2015 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Chromium did not properly consider the scheme when
determining whether a URL is associated with a WebUI SiteInstance. If a
user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to bypass security restrictions.
(CVE-2015-1266)

It was discovered that Blink did not properly restrict the creation
context during creation of a DOM wrapper. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to bypass same-origin restrictions. (CVE-2015-1267, CVE-2015-1268)

It was discovered that Chromium did not properly canonicalize DNS hostnames
before comparing to HSTS or HPKP preload entries. An attacker could
potentially exploit this to bypass intended access restrictions.
(CVE-2015-1269)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS oxide-qt 1.7.9-0ubuntu0.14.04.1

Vulnerabilities 4

References

  • report
    https://ubuntu.com/security/CVE-2015-1266
  • report
    https://ubuntu.com/security/CVE-2015-1267
  • report
    https://ubuntu.com/security/CVE-2015-1268
  • report
    https://ubuntu.com/security/CVE-2015-1269