CVE-2015-3752
CVE-2015-3752
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.
EPSS 3.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
webkitgtk Ubuntu:14.04:LTS
- Versions
- 2.2.1-2ubuntu2
- 2.3.2-1ubuntu2
- 2.3.2-1ubuntu3
- 2.3.2-1ubuntu4
- 2.3.2-1ubuntu5
- 2.3.2-1ubuntu6
- 2.3.4-1ubuntu2
- 2.3.90-1ubuntu1
- 2.3.91-0ubuntu1
- 2.4.0-1ubuntu2
- 2.4.2-1ubuntu0.1
- 2.4.3-1ubuntu2
- 2.4.4-1~ubuntu1
- 2.4.7-1~ubuntu1
- 2.4.8-1ubuntu1~ubuntu14.04.1
- Affected ranges
- ECOSYSTEM: < 2.4.10-0ubuntu0.14.04.1
Update to 2.4.10-0ubuntu0.14.04.1
webkitgtk Ubuntu:16.04:LTS
- Versions
- 2.4.9-2ubuntu2
- Affected ranges
- ECOSYSTEM: < 2.4.10-0ubuntu1
Update to 2.4.10-0ubuntu1
qtwebkit-opensource-src Ubuntu:16.04:LTS
- Versions
- 5.4.2+dfsg-1ubuntu2.1
- 5.5.1+dfsg-2ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebkit-source Ubuntu:16.04:LTS
- Versions
- 2.3.2-0ubuntu10
- 2.3.2-0ubuntu11
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://www.securitytracker.com/id/1033274
- https://support.apple.com/kb/HT205030
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
- http://www.securityfocus.com/bid/76341
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html
- https://support.apple.com/kb/HT205033
- http://www.ubuntu.com/usn/USN-2937-1
- https://nvd.nist.gov/vuln/detail/CVE-2015-3752