CVE-2015-3750
First published: Sun Aug 16 2015(Updated: )
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iPhone OS | <=8.4 | |
| Apple Safari | >=6.0<6.2.8 | |
| Apple Safari | >=7.0<7.1.8 | |
| Apple Safari | >=8.0<8.0.8 | |
| Apple iPhone OS | <8.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
- http://www.securityfocus.com/bid/76341
- http://www.securitytracker.com/id/1033274
- https://support.apple.com/kb/HT205030
- https://support.apple.com/kb/HT205033
- collector/nvd-index
- agent/author
- agent/references
- agent/severity
- agent/last-modified-date
- agent/event
- agent/type
- agent/tags
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/apple
- canonical/apple iphone os
- version/apple iphone os/8.4
- canonical/apple safari
- version/apple safari/6.0
- version/apple safari/7.0
- version/apple safari/8.0