CVE-2015-1317
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers...
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
Exploit likelihood
What each source reports
NVD Score used
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
CVE-2015-1317- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
CVE-2015-1317- Updated
- 2026-11-02
EUVDEUVD-2015-1458 No score
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
EUVD-2015-1458- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4j2w-6h2r-8v7h No score
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers...
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
GHSA-4j2w-6h2r-8v7h- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1317 No score
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
UBUNTU-CVE-2015-1317- Updated
- 2026-11-02
OSVUSN-2556-1 No score
oxide-qt vulnerabilities
It was discovered that Chromium did not properly handle the interaction of IPC, the gamepad API and V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1233)
A buffer overflow was discovered in the GPU service. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2015-1234)
It was discovered that Oxide did not correctly manage the lifetime of BrowserContext, resulting in a potential use-after-free in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1317)
- Record
USN-2556-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oxide-qtUbuntu:14.04:LTS |
before 1.5.6-0ubuntu0.14.04.2, plus listed versions 1.0.0~bzr437-0ubuntu11.0.0~bzr452-0ubuntu11.0.0~bzr475-0ubuntu11.0.0~bzr490-0ubuntu11.0.0~bzr501-0ubuntu1 Show 9 moreShow less1.0.0~bzr501-0ubuntu21.0.4-0ubuntu0.14.04.11.0.5-0ubuntu0.14.04.11.1.2-0ubuntu0.14.04.11.2.5-0ubuntu0.14.04.11.3.4-0ubuntu0.14.04.11.4.2-0ubuntu0.14.04.11.4.3-0ubuntu0.14.04.11.5.5-0ubuntu0.14.04.3 |
1.5.6-0ubuntu0.14.04.2 |
oxide-qtUbuntu:14.04:LTS From an advisory covering 3 CVEs |
before 1.5.6-0ubuntu0.14.04.2, plus listed versions 1.0.0~bzr437-0ubuntu11.0.0~bzr452-0ubuntu11.0.0~bzr475-0ubuntu11.0.0~bzr490-0ubuntu11.0.0~bzr501-0ubuntu1 Show 9 moreShow less1.0.0~bzr501-0ubuntu21.0.4-0ubuntu0.14.04.11.0.5-0ubuntu0.14.04.11.1.2-0ubuntu0.14.04.11.2.5-0ubuntu0.14.04.11.3.4-0ubuntu0.14.04.11.4.2-0ubuntu0.14.04.11.4.3-0ubuntu0.14.04.11.5.5-0ubuntu0.14.04.3 |
1.5.6-0ubuntu0.14.04.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1317 is a high vulnerability (CVSS 7.5) in Oxide Project Oxide, published April 7, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in oxide-qt 1.5.6-0ubuntu0.14.04.2.