Mac OS X : Apple Safari < 6.2.7 / 7.1.7 / 8.0.7 Multiple Vulnerabilities

Medium Nessus Plugin ID 84491

Synopsis

The web browser installed on the remote host is affected by multiple vulnerabilities.

Description

The version of Apple Safari installed on the remote Mac OS X host is prior to 6.2.7 / 7.1.7 / 8.0.7. It is, therefore, affected by the following vulnerabilities :

- A flaw exists in WebKit Page Loading due to the Origin request header being preserved for cross-origin redirects. A remote attacker can exploit this, via a specially crafted web page, to circumvent cross-site request forgery (XSRF) protections. (CVE-2015-3658)

- A flaw exists in the WebKit Storage's SQLite authorizer due to insufficient comparison. A remote attacker can exploit this, via a specially crafted web page, to invoke arbitrary SQL functions, resulting in a denial of service condition or executing arbitrary code.
(CVE-2015-3659)

- An information disclosure vulnerability exists in WebKit PDF due to improper restrictions, related to JavaScript execution, of links embedded in PDF files. A remote attacker can exploit this, via a specially crafted PDF file, to disclose sensitive information from the file system, including cookies. (CVE-2015-3660)

- An information disclosure vulnerability exists in WebKit due to improper restrictions on renaming WebSQL tables.
A remote attacker can exploit this, via a specially crafted website, to access WebSQL databases belonging to other websites. (CVE-2015-3727)

Solution

Upgrade to Apple Safari 6.2.7 / 7.1.7 / 8.0.7 or later.

See Also

https://support.apple.com/en-us/HT204950

Plugin Details

Severity: Medium

ID: 84491

File Name: macosx_Safari8_0_7.nasl

Version: 1.5

Type: local

Agent: macosx

Published: 2015/07/01

Updated: 2019/11/22

Dependencies: 31604

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2015-3727

CVSS v2.0

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:apple:safari

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, MacOSX/Safari/Installed

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2015/06/30

Vulnerability Publication Date: 2015/06/30

Reference Information

CVE: CVE-2015-3658, CVE-2015-3659, CVE-2015-3660, CVE-2015-3727