PT-2015-2265 · Apple · Safari

Ben Toms · Published 2015-10-09 · Updated 2016-12-09 · CVE-2015-5780

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 9

Description The issue is related to the Safari Extensions implementation, which does not require user confirmation before replacing an installed extension. This has an unspecified impact and attack vectors. The vulnerability can be exploited by a remote attacker to affect the security of information.

Recommendations For Apple Safari versions prior to 9, update to version 9 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-11619

CVE-2015-5780

Affected Products

Safari

References · 5

• https://support.apple.com/HT205265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5780 · Security Note
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00007.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11619 · Security Note
• http://securitytracker.com/id/1033688 · Note