CVE-2016-1573: Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-22 · updated 2026-06-17
Weakness: CWE-416

Description

Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a scope.

Affected products

Canonical unity8 (Ubuntu): before 8.11\+16.04.20160122-0ubuntu1 — fixed in 8.11\+16.04.20160122-0ubuntu1

How to fix

Upgrade to a fixed version: Canonical unity8 (Ubuntu) 8.11\+16.04.20160122-0ubuntu1. Check the vendor advisory for mitigations.

References

https://bazaar.launchpad.net/~unity-team/unity8/stable/revision/2138
https://bazaar.launchpad.net/~unity-team/unity8/stable/revision/2138

Get alerted when CVE-2016-1573 or the next vulnerability affects your stack