CVE-2015-5825: Infoleak
First published: Fri Sep 18 2015(Updated: )
WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Mobile Safari | <=8.0.8 | |
| iStyle @cosme iPhone OS | <=8.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00007.html
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
- http://www.securityfocus.com/bid/76766
- http://www.securitytracker.com/id/1033609
- https://support.apple.com/HT205212
- https://support.apple.com/HT205265
Frequently Asked Questions
What is the severity of CVE-2015-5825?
CVE-2015-5825 is categorized as a medium severity vulnerability.
How do I fix CVE-2015-5825?
To fix CVE-2015-5825, update your Apple Safari or iPhone OS to version 9 or higher.
What does CVE-2015-5825 exploit?
CVE-2015-5825 exploits improper restrictions in the Performance API, allowing attackers to access sensitive user data.
Which versions of software are affected by CVE-2015-5825?
CVE-2015-5825 affects Apple Safari versions up to 8.0.8 and Apple iPhone OS versions up to 8.4.1.
Can CVE-2015-5825 lead to data leaks?
Yes, CVE-2015-5825 can potentially lead to data leaks of browser history and network traffic.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/apple mobile safari
- version/apple mobile safari/8.0.8
- canonical/istyle @cosme iphone os
- version/istyle @cosme iphone os/8.4.1