CVE-2015-3658

Опубликовано: 03 июл. 2015

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.

Ссылки

http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
http://support.apple.com/kb/HT204941
Vendor Advisory
http://support.apple.com/kb/HT204950
Vendor Advisory
http://www.securityfocus.com/bid/75492
http://www.securitytracker.com/id/1032754
http://www.ubuntu.com/usn/USN-2937-1
http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
http://support.apple.com/kb/HT204941
Vendor Advisory
http://support.apple.com/kb/HT204950
Vendor Advisory
http://www.securityfocus.com/bid/75492
http://www.securitytracker.com/id/1032754
http://www.ubuntu.com/usn/USN-2937-1

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Версия до 6.2.6 (включая)

cpe:2.3:a:apple:safari:7.0:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.0.6:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.1.0:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.1.2:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.1.3:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.1.4:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.1.5:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:7.1.6:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:8.0:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:8.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:8.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:8.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:8.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:8.0.6:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 8.3 (включая)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Версия до 10.10.3 (включая)

EPSS

Процентиль: 50%

0.00273

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-254

Связанные уязвимости

CVE-2015-3658

ubuntu

больше 10 лет назад

GHSA-7w75-mgjq-f5m7

github

больше 3 лет назад

openSUSE-SU-2016:0915-1

suse-cvrf

почти 10 лет назад

Security update for webkitgtk