CVE-2015-3750
First published: Sun Aug 16 2015(Updated: )
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| iStyle @cosme iPhone OS | <=8.4 | |
| Apple Mobile Safari | >=6.0<6.2.8 | |
| Apple Mobile Safari | >=7.0<7.1.8 | |
| Apple Mobile Safari | >=8.0<8.0.8 | |
| iStyle @cosme iPhone OS | <8.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
- http://www.securityfocus.com/bid/76341
- http://www.securitytracker.com/id/1033274
- https://support.apple.com/kb/HT205030
- https://support.apple.com/kb/HT205033
Frequently Asked Questions
What is the severity of CVE-2015-3750?
CVE-2015-3750 has a medium severity rating, as it allows possible man-in-the-middle attacks due to insufficient enforcement of HSTS for CSP report requests.
How do I fix CVE-2015-3750?
To mitigate CVE-2015-3750, users should update their Apple Safari browser and iOS to the latest versions that incorporate the security patch.
Which versions of Safari are affected by CVE-2015-3750?
CVE-2015-3750 affects Safari versions prior to 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8.
Which versions of iOS are impacted by CVE-2015-3750?
CVE-2015-3750 impacts iOS versions before 8.4.1.
What is the impact of CVE-2015-3750?
The impact of CVE-2015-3750 can allow attackers to intercept and manipulate CSP report requests, potentially leading to security breaches.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/istyle @cosme iphone os
- version/istyle @cosme iphone os/8.4
- canonical/apple mobile safari
- version/apple mobile safari/6.0
- version/apple mobile safari/7.0
- version/apple mobile safari/8.0