WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Safari | Apple | 6.0 (including) | 6.2.8 (excluding) |
| Safari | Apple | 7.0 (including) | 7.1.8 (excluding) |
| Safari | Apple | 8.0 (including) | 8.0.8 (excluding) |
| Qtwebkit-opensource-src | Ubuntu | devel | * |
| Qtwebkit-opensource-src | Ubuntu | esm-infra/xenial | * |
| Qtwebkit-opensource-src | Ubuntu | trusty | * |
| Qtwebkit-opensource-src | Ubuntu | vivid | * |
| Qtwebkit-opensource-src | Ubuntu | wily | * |
| Qtwebkit-opensource-src | Ubuntu | xenial | * |
| Qtwebkit-opensource-src | Ubuntu | yakkety | * |
| Qtwebkit-source | Ubuntu | devel | * |
| Qtwebkit-source | Ubuntu | esm-apps/xenial | * |
| Qtwebkit-source | Ubuntu | precise | * |
| Qtwebkit-source | Ubuntu | trusty | * |
| Qtwebkit-source | Ubuntu | vivid | * |
| Qtwebkit-source | Ubuntu | wily | * |
| Qtwebkit-source | Ubuntu | xenial | * |
| Qtwebkit-source | Ubuntu | yakkety | * |
| Webkit | Ubuntu | precise | * |
| Webkitgtk | Ubuntu | devel | * |
| Webkitgtk | Ubuntu | esm-apps/xenial | * |
| Webkitgtk | Ubuntu | trusty | * |
| Webkitgtk | Ubuntu | vivid | * |
| Webkitgtk | Ubuntu | wily | * |
| Webkitgtk | Ubuntu | xenial | * |
| Webkitgtk | Ubuntu | yakkety | * |