PT-2015-2266 · Apple · Webkit+1

Lorenzo Fontana

·

Publicado

2015-10-09

·

Atualizado

2018-10-30

·

CVE-2015-5828

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 9
Description The issue concerns the API in the WebKit Plug-ins component, which fails to notify plugins of HTTP Redirection status codes. This allows remote attackers to bypass intended request restrictions by crafting a specific web site. The vulnerability exists due to insufficient input validation, enabling a remote attacker to circumvent existing request restrictions using a specially formed web site.
Recommendations For Apple Safari versions prior to 9, update to version 9 or later to resolve the issue.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-11620
CVE-2015-5828
MGASA-2016-0116

Produtos afetados

Safari
Webkit