CVE-2015-3753: Infoleak
First published: Sun Aug 16 2015(Updated: )
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Safari | >=6.0<6.2.8 | |
| Apple Safari | >=7.0<7.1.8 | |
| Apple Safari | >=8.0<8.0.8 | |
| Apple iPhone OS | <8.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/weakness
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/apple
- canonical/apple safari
- version/apple safari/6.0
- version/apple safari/7.0
- version/apple safari/8.0
- canonical/apple iphone os