[월:] 2016년 06월

USN-2994-1: libxml2 vulnerabilities Ubuntu Security Notice USN-2994-1 6th June, 2016 libxml2 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary Several security issues were fixed in libxml2. Software description libxml2 – GNOME XML library Details It was discovered that libxml2 incorrectly handled certain malformeddocuments. If a user or automated system were tricked into opening aspecially crafted document, an attacker could possibly cause libxml2 tocrash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073,CVE-2016-3627, CVE-2016-3705, CVE-2016-4447) It was discovered that libxml2 incorrectly handled certain malformeddocuments. If a user or automated system were tricked into opening aspecially crafted document, an attacker could cause libxml2 to crash,resulting in a denial of service, or possibly execute arbitrary code.(CVE-2016-1762, CVE-2016-1834) Mateusz Jurczyk discovered that libxml2 incorrectly handled certainmalformed documents. If a [ more… ]

USN-2992-1: Oxide vulnerabilities Ubuntu Security Notice USN-2992-1 6th June, 2016 oxide-qt vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Ubuntu 15.10 Ubuntu 14.04 LTS Summary Several security issues were fixed in Oxide. Software description oxide-qt – Web browser engine for Qt (QML plugin) Details An unspecified security issue was discovered in Blink. If a user weretricked in to opening a specially crafted website, an attacker couldpotentially exploit this to bypass same-origin restrictions.(CVE-2016-1673) An issue was discovered with Document reattachment in Blink in somecircumstances. If a user were tricked in to opening a specially craftedwebsite, an attacker could potentially exploit this to bypass same-originrestrictions. (CVE-2016-1675) A type confusion bug was discovered in V8. If a user were tricked in toopening a specially crafted website, an attacker could potentially exploitthis to obtain sensitive information. (CVE-2016-1677) [ more… ]