{"id":"CVE-2015-1321","aliases":["EUVD-2015-1462","GHSA-f8hr-c3f3-c266","UBUNTU-CVE-2015-1321","USN-2570-1"],"status":"published","title":"Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows...","description":"Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01978,"percentile":0.80649,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-04-27T00:00:00Z","modified":"2026-06-17T00:22:11Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"oxide-qt","fixed_in":["1.6.5-0ubuntu0.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-0ubuntu0.14.04.1"}]}],"versions":["1.0.0~bzr437-0ubuntu1","1.0.0~bzr452-0ubuntu1","1.0.0~bzr475-0ubuntu1","1.0.0~bzr490-0ubuntu1","1.0.0~bzr501-0ubuntu1","1.0.0~bzr501-0ubuntu2","1.0.4-0ubuntu0.14.04.1","1.0.5-0ubuntu0.14.04.1","1.1.2-0ubuntu0.14.04.1","1.2.5-0ubuntu0.14.04.1","1.3.4-0ubuntu0.14.04.1","1.4.2-0ubuntu0.14.04.1","1.4.3-0ubuntu0.14.04.1","1.5.5-0ubuntu0.14.04.3","1.5.6-0ubuntu0.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"oxide-qt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-0ubuntu0.14.04.1"}]}],"versions":["1.0.0~bzr437-0ubuntu1","1.0.0~bzr452-0ubuntu1","1.0.0~bzr475-0ubuntu1","1.0.0~bzr490-0ubuntu1","1.0.0~bzr501-0ubuntu1","1.0.0~bzr501-0ubuntu2","1.0.4-0ubuntu0.14.04.1","1.0.5-0ubuntu0.14.04.1","1.1.2-0ubuntu0.14.04.1","1.2.5-0ubuntu0.14.04.1","1.3.4-0ubuntu0.14.04.1","1.4.2-0ubuntu0.14.04.1","1.4.3-0ubuntu0.14.04.1","1.5.5-0ubuntu0.14.04.3","1.5.6-0ubuntu0.14.04.2"],"bundled":12}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"oxide_project","product":"oxide"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2570-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1321"},{"url":"https://github.com/advisories/GHSA-f8hr-c3f3-c266"},{"url":"https://ubuntu.com/security/CVE-2015-1321","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2570-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3333","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1321","description":"Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.","status":"published","published":"2015-04-29T20:00:00Z","modified":"2024-08-06T04:40:18.571Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1462","description":"Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.","status":"published","published":"2015-04-29T20:00:00Z","modified":"2024-08-06T04:40:18Z","updated_at":"2026-11-03T02:22:16.145787Z"}],"ghsa":[{"id":"GHSA-f8hr-c3f3-c266","title":"Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows...","description":"Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.","status":"published","published":"2022-05-17T04:13:39Z","modified":"2023-01-28T05:01:23Z","updated_at":"2026-11-02T14:43:33.286467Z"}],"nvd":[{"id":"CVE-2015-1321","description":"Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.","status":"published","published":"2015-04-29T20:59:00.077Z","modified":"2026-06-17T00:22:11.497Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"UBUNTU-CVE-2015-1321","description":"Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.","status":"published","published":"2015-04-27T00:00:00Z","modified":"2026-02-04T03:28:28.366671Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2570-1","title":"oxide-qt vulnerabilities","description":"An issue was discovered in the HTML parser in Blink. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit this to bypass same-origin restrictions.\n(CVE-2015-1235)\n\nAn issue was discovered in the Web Audio API implementation in Blink. If\na user were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to bypass same-origin restrictions.\n(CVE-2015-1236)\n\nA use-after-free was discovered in Chromium. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthis to cause a denial of service via renderer crash, or execute arbitrary\ncode with the privileges of the sandboxed render process. (CVE-2015-1237)\n\nAn out-of-bounds write was discovered in Skia. If a user were tricked in\nto opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via application crash or execute\narbitrary code with the privileges of the user invoking the program.\n(CVE-2015-1238)\n\nAn out-of-bounds read was discovered in the WebGL implementation. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via renderer\ncrash. (CVE-2015-1240)\n\nAn issue was discovered with the interaction of page navigation and touch\nevent handling. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to conduct\n\"tap jacking\" attacks. (CVE-2015-1241)\n\nA type confusion bug was discovered in V8. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthis to cause a denial of service via renderer crash, or execute arbitrary\ncode with the privileges of the sandboxed render process. (CVE-2015-1242)\n\nIt was discovered that websocket connections were not upgraded whenever a\nHSTS policy is active. A remote attacker could potentially exploit this\nto conduct a machine-in-the-middle (MITM) attack. (CVE-2015-1244)\n\nAn out-of-bounds read was discovered in Blink. If a user were tricked in\nto opening a specially crafted website, an attacker could potentially\nexploit this to cause a denial of service via renderer crash.\n(CVE-2015-1246)\n\nMultiple security issues were discovered in Chromium. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to read uninitialized memory, cause a denial\nof service via application crash or execute arbitrary code with the\nprivileges of the user invoking the program. (CVE-2015-1249)\n\nA use-after-free was discovered in the file picker implementation. If a\nuser were tricked in to opening a specially crafted website, an attacker\ncould potentially exploit this to cause a denial of service via\napplication crash or execute arbitrary code with the privileges of the\nuser invoking the program. (CVE-2015-1321)\n\nMultiple security issues were discovered in V8. If a user were tricked\nin to opening a specially crafted website, an attacker could potentially\nexploit these to read uninitialized memory, cause a denial of service via\nrenderer crash or execute arbitrary code with the privileges of the\nsandboxed render process. (CVE-2015-3333)\n","status":"published","published":"2015-04-27T16:13:50Z","modified":"2026-02-10T04:40:53Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}