PT-2015-5138 · Apple · Webkit+1

Zachary Durber

·

Publicado

2015-05-08

·

Atualizado

2016-11-28

·

CVE-2015-1156

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.2.6 Apple Safari versions 7.x prior to 7.1.6 Apple Safari versions 8.x prior to 8.0.6
Description The issue concerns the page-loading implementation in WebKit, which does not properly handle the rel attribute in an A element. This allows remote attackers to bypass the Same Origin Policy for a link's target and spoof the user interface via a crafted web site.
Recommendations For Apple Safari versions prior to 6.2.6, update to version 6.2.6 or later. For Apple Safari versions 7.x prior to 7.1.6, update to version 7.1.6 or later. For Apple Safari versions 8.x prior to 8.0.6, update to version 8.0.6 or later.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-1156
MGASA-2016-0116

Produtos afetados

Safari
Webkit