CVE-2015-3751

MEDIUM

Description

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element.

References

http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html

http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html

http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html

http://www.securityfocus.com/bid/76341

http://www.securitytracker.com/id/1033274

https://support.apple.com/kb/HT205030

https://support.apple.com/kb/HT205033

Details

Source: MITRE

Published: 2015-08-16

Updated: 2019-02-07

Type: CWE-254

Risk Information

CVSS v2.0

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Tenable Plugins

View all (9 total)

IDNameProductFamilySeverity
9333Apple TV < 7.2.1 Multiple VulnerabilitiesNessus Network MonitorInternet Services
medium
90315Apple TV < 7.2.1 Multiple VulnerabilitiesNessusMisc.
high
89950openSUSE Security Update : webkit2gtk3 (openSUSE-2016-340)NessusSuSE Local Security Checks
medium
8978Apple iOS < 8.4.1 Multiple VulnerabilitiesNessus Network MonitorMobile Devices
critical
8949Safari < 6.2.8 / 7.1.8 / 8.0.8 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
medium
85446Mac OS X : Apple Safari < 6.2.8 / 7.1.8 / 8.0.8 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
medium
85409Mac OS X Multiple Vulnerabilities (Security Update 2015-006)NessusMacOS X Local Security Checks
high
85408Mac OS X 10.10.x < 10.10.5 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
high
85407Apple iOS < 8.4.1 Multiple VulnerabilitiesNessusMobile Devices
high