CVE-2015-1317
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers...
CVE-2015-1317 is a high vulnerability (CVSS 7.5) in Oxide Project Oxide, published April 7, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in oxide-qt 1.5.6-0ubuntu0.14.04.2.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.99%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.5.6-0ubuntu0.14.04.2oxide-qt +1 more
Description
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oxide-qtUbuntu:14.04:LTS | before 1.5.6-0ubuntu0.14.04.2, plus listed versions 1.0.0~bzr437-0ubuntu11.0.0~bzr452-0ubuntu11.0.0~bzr475-0ubuntu11.0.0~bzr490-0ubuntu11.0.0~bzr501-0ubuntu1 Show 9 moreShow less1.0.0~bzr501-0ubuntu21.0.4-0ubuntu0.14.04.11.0.5-0ubuntu0.14.04.11.1.2-0ubuntu0.14.04.11.2.5-0ubuntu0.14.04.11.3.4-0ubuntu0.14.04.11.4.2-0ubuntu0.14.04.11.4.3-0ubuntu0.14.04.11.5.5-0ubuntu0.14.04.3 | 1.5.6-0ubuntu0.14.04.2 |
oxide-qtUbuntu:14.04:LTS From an advisory covering 3 CVEs | before 1.5.6-0ubuntu0.14.04.2, plus listed versions 1.0.0~bzr437-0ubuntu11.0.0~bzr452-0ubuntu11.0.0~bzr475-0ubuntu11.0.0~bzr490-0ubuntu11.0.0~bzr501-0ubuntu1 Show 9 moreShow less1.0.0~bzr501-0ubuntu21.0.4-0ubuntu0.14.04.11.0.5-0ubuntu0.14.04.11.1.2-0ubuntu0.14.04.11.2.5-0ubuntu0.14.04.11.3.4-0ubuntu0.14.04.11.4.2-0ubuntu0.14.04.11.4.3-0ubuntu0.14.04.11.5.5-0ubuntu0.14.04.3 | 1.5.6-0ubuntu0.14.04.2 |
What each source reports
NVD Score used
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
CVE-2015-1317- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
CVE-2015-1317- Updated
- 2026-11-02
EUVDEUVD-2015-1458No score
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
EUVD-2015-1458- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4j2w-6h2r-8v7hNo score
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers...
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
GHSA-4j2w-6h2r-8v7h- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1317No score
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
- Record
UBUNTU-CVE-2015-1317- Updated
- 2026-11-02
OSVUSN-2556-1No score
oxide-qt vulnerabilities
It was discovered that Chromium did not properly handle the interaction of IPC, the gamepad API and V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1233)
A buffer overflow was discovered in the GPU service. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash. (CVE-2015-1234)
It was discovered that Oxide did not correctly manage the lifetime of BrowserContext, resulting in a potential use-after-free in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1317)
- Record
USN-2556-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.