Ubuntu 14.04 LTS : oxide-qt vulnerabilities (USN-2320-1)
High Nessus Plugin ID 77300
SynopsisThe remote Ubuntu host is missing one or more security-related patches.
DescriptionA use-after-free was discovered in the websockets implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash. (CVE-2014-3165)
An issue was discovered in the Public Key Pinning implementation in Chromium. An attacker could potentially exploit this to obtain sensitive information. (CVE-2014-3166)
Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-3167).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected liboxideqtcore0, oxideqt-codecs and / or oxideqt-codecs-extra packages.