CVE-2015-1329

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1329.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/76174Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2677-1Patch, Vendor Advisory
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1329.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/76174Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2677-1Patch, Vendor Advisory

Timeline

Published: Sep 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-13306.8unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are e CVE-2015-13314.9lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.CVE-2015-13328.8The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to CVE-2015-13334.9Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial CVE-2015-13344.6attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux CVE-2015-13357.2lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink atta CVE-2015-13367.8The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to CVE-2015-13376.8Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof CVE-2015-13387.2kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a CVE-2015-13396.2Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of se CVE-2015-13408.1LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() fun CVE-2015-13417.8Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is