GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

USN-2960-1 (UBUNTU-CVE-2016-1660)

Vulnerability from osv_ubuntu – Published: 2016-05-18 23:15 – Updated: 2026-04-22 07:36 – Source website
VLAI
Summary
oxide-qt vulnerabilities
Details

An out of bounds write was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code. (CVE-2016-1660)

It was discovered that Blink assumes that a frame which passes same-origin checks is local in some cases. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code. (CVE-2016-1661)

A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code. (CVE-2016-1663)

It was discovered that the JSGenericLowering class in V8 mishandles comparison operators. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-1665)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code. (CVE-2016-1666)

It was discovered that the TreeScope::adoptIfNeeded function in Blink does not prevent script execution during node-adoption operations. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-1667)

It was discovered that the forEachForBinding in the V8 bindings in Blink uses an improper creation context. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-1668)

A buffer overflow was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code. (CVE-2016-1669)

A race condition was discovered in ResourceDispatcherHostImpl in Chromium. An attacker could potentially exploit this to make arbitrary HTTP requests. (CVE-2016-1670)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-1667",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1668",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1669",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1670",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "liboxideqt-qmlplugin",
            "binary_version": "1.14.9-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "liboxideqtcore0",
            "binary_version": "1.14.9-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "liboxideqtquick0",
            "binary_version": "1.14.9-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "oxideqmlscene",
            "binary_version": "1.14.9-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "oxideqt-chromedriver",
            "binary_version": "1.14.9-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "oxideqt-codecs",
            "binary_version": "1.14.9-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "oxideqt-codecs-extra",
            "binary_version": "1.14.9-0ubuntu0.14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "oxide-qt",
        "purl": "pkg:deb/ubuntu/oxide-qt@1.14.9-0ubuntu0.14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.9-0ubuntu0.14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0~bzr437-0ubuntu1",
        "1.0.0~bzr452-0ubuntu1",
        "1.0.0~bzr475-0ubuntu1",
        "1.0.0~bzr490-0ubuntu1",
        "1.0.0~bzr501-0ubuntu1",
        "1.0.0~bzr501-0ubuntu2",
        "1.0.4-0ubuntu0.14.04.1",
        "1.0.5-0ubuntu0.14.04.1",
        "1.1.2-0ubuntu0.14.04.1",
        "1.2.5-0ubuntu0.14.04.1",
        "1.3.4-0ubuntu0.14.04.1",
        "1.4.2-0ubuntu0.14.04.1",
        "1.4.3-0ubuntu0.14.04.1",
        "1.5.5-0ubuntu0.14.04.3",
        "1.5.6-0ubuntu0.14.04.2",
        "1.6.5-0ubuntu0.14.04.1",
        "1.6.6-0ubuntu0.14.04.1",
        "1.7.8-0ubuntu0.14.04.1",
        "1.7.9-0ubuntu0.14.04.1",
        "1.8.4-0ubuntu0.14.04.2",
        "1.9.1-0ubuntu0.14.04.2",
        "1.9.5-0ubuntu0.14.04.1",
        "1.10.3-0ubuntu0.14.04.1",
        "1.11.3-0ubuntu0.14.04.1",
        "1.11.4-0ubuntu0.14.04.1",
        "1.12.5-0ubuntu0.14.04.1",
        "1.12.6-0ubuntu0.14.04.1",
        "1.12.7-0ubuntu0.14.04.1",
        "1.13.6-0ubuntu0.14.04.1",
        "1.14.7-0ubuntu0.14.04.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-1667",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1668",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1669",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1670",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "liboxideqt-qmlplugin",
            "binary_version": "1.14.9-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "liboxideqtcore0",
            "binary_version": "1.14.9-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "liboxideqtquick0",
            "binary_version": "1.14.9-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "oxideqt-codecs",
            "binary_version": "1.14.9-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "oxideqt-codecs-extra",
            "binary_version": "1.14.9-0ubuntu0.16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "oxide-qt",
        "purl": "pkg:deb/ubuntu/oxide-qt@1.14.9-0ubuntu0.16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.9-0ubuntu0.16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.5-0ubuntu1",
        "1.10.3-0ubuntu0.15.10.1",
        "1.10.3-0ubuntu0.15.10.2",
        "1.11.3-0ubuntu3",
        "1.11.4-0ubuntu1",
        "1.11.5-0ubuntu1",
        "1.12.5-0ubuntu1",
        "1.12.6-0ubuntu1",
        "1.12.7-0ubuntu1",
        "1.13.6-0ubuntu1",
        "1.14.7-0ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "An out of bounds write was discovered in Blink. If a user were tricked in\nto opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash, or execute\narbitrary code. (CVE-2016-1660)\n\nIt was discovered that Blink assumes that a frame which passes same-origin\nchecks is local in some cases. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit this to\ncause a denial of service via renderer crash, or execute arbitrary code.\n(CVE-2016-1661)\n\nA use-after-free was discovered in the V8 bindings in Blink. If a user\nwere tricked in to opening a specially crafted website, an attacker could\npotentially exploit this to cause a denial of service via renderer crash,\nor execute arbitrary code. (CVE-2016-1663)\n\nIt was discovered that the JSGenericLowering class in V8 mishandles\ncomparison operators. If a user were tricked in to opening a specially\ncrafted website, an attacker could potentially exploit this to obtain\nsensitive information. (CVE-2016-1665)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code.\n(CVE-2016-1666)\n\nIt was discovered that the TreeScope::adoptIfNeeded function in Blink\ndoes not prevent script execution during node-adoption operations. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to bypass same origin restrictions.\n(CVE-2016-1667)\n\nIt was discovered that the forEachForBinding in the V8 bindings in Blink\nuses an improper creation context. If a user were tricked in to opening a\nspecially crafted website, an attacker could potentially exploit this to\nbypass same origin restrictions. (CVE-2016-1668)\n\nA buffer overflow was discovered in V8. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthis to cause a denial of service via renderer crash, or execute arbitrary\ncode. (CVE-2016-1669)\n\nA race condition was discovered in ResourceDispatcherHostImpl in Chromium.\nAn attacker could potentially exploit this to make arbitrary HTTP\nrequests. (CVE-2016-1670)\n",
  "id": "USN-2960-1",
  "modified": "2026-04-22T07:36:33Z",
  "published": "2016-05-18T23:15:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2960-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1660"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1661"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1663"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1665"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1666"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1667"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1668"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1669"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1670"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "oxide-qt vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-1660",
    "UBUNTU-CVE-2016-1661",
    "UBUNTU-CVE-2016-1663",
    "UBUNTU-CVE-2016-1665",
    "UBUNTU-CVE-2016-1666",
    "UBUNTU-CVE-2016-1667",
    "UBUNTU-CVE-2016-1668",
    "UBUNTU-CVE-2016-1669",
    "UBUNTU-CVE-2016-1670"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.