PT-2015-1944 · Apple · Webkit+1

Xisigr · Published 2015-08-16 · Updated 2019-02-07 · CVE-2015-3754

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.2.8 Apple Safari versions 7.x prior to 7.1.8 Apple Safari versions 8.x prior to 8.0.8

Description The issue is related to the private-browsing implementation in WebKit, which does not prevent caching of HTTP authentication credentials. This makes it easier for remote attackers to track users via a crafted web site. The vulnerability in the WebKit component of the Safari browser is associated with a lack of protection for service data, allowing a remote attacker to track user actions using a specially formed website.

Recommendations For Apple Safari versions prior to 6.2.8, update to version 6.2.8 or later. For Apple Safari versions 7.x prior to 7.1.8, update to version 7.1.8 or later. For Apple Safari versions 8.x prior to 8.0.8, update to version 8.0.8 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-11290

CVE-2015-3754

MGASA-2016-0116

Affected Products

Safari

Webkit

References · 30

• https://ubuntu.com/security/CVE-2015-3754 · Vendor Advisory
• https://support.apple.com/kb/HT205033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3754 · Security Note
• http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0116.html · Security Note
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0116 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3754 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3754 · Security Note
• https://bdu.fstec.ru/vul/2015-11290 · Security Note
• http://webkitgtk.org/security/WSA-2016-0001.html · Note
• http://webkitgtk.org/2015/11/11/webkitgtk2.10.4-released.html · Note
• http://webkitgtk.org/2016/01/29/webkitgtk2.10.7-released.html · Note
• http://webkitgtk.org/2015/07/08/webkitgtk2.8.4-released.html · Note
• http://webkitgtk.org/2015/10/14/webkitgtk2.10.1-released.html · Note