CVE-2015-3752: Infoleak
First published: Sun Aug 16 2015(Updated: )
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Safari | >=6.0<6.2.8 | |
| Apple Safari | >=7.0<7.1.8 | |
| Apple Safari | >=8.0<8.0.8 | |
| Apple iPhone OS | <8.4.1 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =15.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
- http://www.securityfocus.com/bid/76341
- http://www.securitytracker.com/id/1033274
- http://www.ubuntu.com/usn/USN-2937-1
- https://support.apple.com/kb/HT205030
- https://support.apple.com/kb/HT205033
- collector/nvd-index
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/apple
- canonical/apple safari
- version/apple safari/6.0
- version/apple safari/7.0
- version/apple safari/8.0
- canonical/apple iphone os
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/15.10