CVE-2014-4465

Опубликовано: 10 дек. 2014

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element.

Комментарий

Per an Apple Security Advisory Apple TV before 7.0.3 was also vulnerable. Per an Apple Security Advisory Apple iOS before 8.1.3 was also vulnerable.

These product additions are reflected in the vulnerable configuration.

Ссылки

http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html
Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html
Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html
Vendor Advisory
http://support.apple.com/HT204245
Vendor Advisory
http://support.apple.com/HT204246
Vendor Advisory
http://support.apple.com/kb/HT6596
Vendor Advisory
http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html
Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html
Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html
Vendor Advisory
http://support.apple.com/HT204245
Vendor Advisory
http://support.apple.com/HT204246
Vendor Advisory
http://support.apple.com/kb/HT6596
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

Версия до 7.0.1 (включая)

Конфигурация 2

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 8.1.2 (включая)

Конфигурация 3

Одно из

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Версия до 6.2.0 (включая)

cpe:2.3:a:apple:safari:7.1.0:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:8.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00977

Низкий

5 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2014-4465

ubuntu

около 11 лет назад

GHSA-j74r-g3fg-pr4g

github

больше 3 лет назад