CVE Vulnerabilities

CVE-2015-3658

Published: Jul 03, 2015 | Modified: Dec 28, 2016
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.

Affected Software

Name Vendor Start Version End Version
Safari Apple * 6.2.6 (including)
Safari Apple 7.0 (including) 7.0 (including)
Safari Apple 7.0.1 (including) 7.0.1 (including)
Safari Apple 7.0.2 (including) 7.0.2 (including)
Safari Apple 7.0.3 (including) 7.0.3 (including)
Safari Apple 7.0.4 (including) 7.0.4 (including)
Safari Apple 7.0.5 (including) 7.0.5 (including)
Safari Apple 7.0.6 (including) 7.0.6 (including)
Safari Apple 7.1.0 (including) 7.1.0 (including)
Safari Apple 7.1.1 (including) 7.1.1 (including)
Safari Apple 7.1.2 (including) 7.1.2 (including)
Safari Apple 7.1.3 (including) 7.1.3 (including)
Safari Apple 7.1.4 (including) 7.1.4 (including)
Safari Apple 7.1.5 (including) 7.1.5 (including)
Safari Apple 7.1.6 (including) 7.1.6 (including)
Safari Apple 8.0 (including) 8.0 (including)
Safari Apple 8.0.1 (including) 8.0.1 (including)
Safari Apple 8.0.2 (including) 8.0.2 (including)
Safari Apple 8.0.3 (including) 8.0.3 (including)
Safari Apple 8.0.4 (including) 8.0.4 (including)
Safari Apple 8.0.5 (including) 8.0.5 (including)
Safari Apple 8.0.6 (including) 8.0.6 (including)
Qtwebkit-opensource-src Ubuntu devel *
Qtwebkit-opensource-src Ubuntu esm-infra/xenial *
Qtwebkit-opensource-src Ubuntu trusty *
Qtwebkit-opensource-src Ubuntu utopic *
Qtwebkit-opensource-src Ubuntu vivid *
Qtwebkit-opensource-src Ubuntu wily *
Qtwebkit-opensource-src Ubuntu xenial *
Qtwebkit-opensource-src Ubuntu yakkety *
Qtwebkit-source Ubuntu devel *
Qtwebkit-source Ubuntu esm-apps/xenial *
Qtwebkit-source Ubuntu precise *
Qtwebkit-source Ubuntu trusty *
Qtwebkit-source Ubuntu utopic *
Qtwebkit-source Ubuntu vivid *
Qtwebkit-source Ubuntu wily *
Qtwebkit-source Ubuntu xenial *
Qtwebkit-source Ubuntu yakkety *
Webkit Ubuntu precise *
Webkitgtk Ubuntu devel *
Webkitgtk Ubuntu esm-apps/xenial *
Webkitgtk Ubuntu trusty *
Webkitgtk Ubuntu utopic *
Webkitgtk Ubuntu vivid *
Webkitgtk Ubuntu wily *
Webkitgtk Ubuntu xenial *
Webkitgtk Ubuntu yakkety *

References