PT-2015-5138 · Apple · Webkit+1

Zachary Durber · Published 2015-05-08 · Updated 2016-11-28 · CVE-2015-1156

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 6.2.6 Apple Safari versions 7.x prior to 7.1.6 Apple Safari versions 8.x prior to 8.0.6

Description The issue concerns the page-loading implementation in WebKit, which does not properly handle the rel attribute in an A element. This allows remote attackers to bypass the Same Origin Policy for a link's target and spoof the user interface via a crafted web site.

Recommendations For Apple Safari versions prior to 6.2.6, update to version 6.2.6 or later. For Apple Safari versions 7.x prior to 7.1.6, update to version 7.1.6 or later. For Apple Safari versions 8.x prior to 8.0.6, update to version 8.0.6 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-1156

MGASA-2016-0116

Affected Products

Safari

Webkit

References · 30

• https://support.apple.com/HT204826 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1156 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0116.html · Security Note
• https://ubuntu.com/security/CVE-2015-1156 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/May/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0116 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-1156 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1156 · Security Note
• http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html · Vendor Advisory
• http://securitytracker.com/id/1032270 · Note
• http://webkitgtk.org/security/WSA-2016-0001.html · Note
• http://webkitgtk.org/2015/11/11/webkitgtk2.10.4-released.html · Note
• http://webkitgtk.org/2016/01/29/webkitgtk2.10.7-released.html · Note
• http://webkitgtk.org/2015/07/08/webkitgtk2.8.4-released.html · Note
• http://webkitgtk.org/2015/10/14/webkitgtk2.10.1-released.html · Note