ID CVE-2015-1075
Summary WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
References
Vulnerable Configurations
  • cpe:2.3:a:apple:safari:6.2.3
    cpe:2.3:a:apple:safari:6.2.3
  • Apple Safari 7.0
    cpe:2.3:a:apple:safari:7.0
  • Apple Safari 7.0.1
    cpe:2.3:a:apple:safari:7.0.1
  • Apple Safari 7.0.2
    cpe:2.3:a:apple:safari:7.0.2
  • Apple Safari 7.0.3
    cpe:2.3:a:apple:safari:7.0.3
  • Apple Safari 7.0.4
    cpe:2.3:a:apple:safari:7.0.4
  • Apple Safari 7.0.5
    cpe:2.3:a:apple:safari:7.0.5
  • cpe:2.3:a:apple:safari:7.0.6
    cpe:2.3:a:apple:safari:7.0.6
  • cpe:2.3:a:apple:safari:7.1.0
    cpe:2.3:a:apple:safari:7.1.0
  • Apple Safari 7.1.1
    cpe:2.3:a:apple:safari:7.1.1
  • cpe:2.3:a:apple:safari:7.1.2
    cpe:2.3:a:apple:safari:7.1.2
  • cpe:2.3:a:apple:safari:7.1.3
    cpe:2.3:a:apple:safari:7.1.3
  • cpe:2.3:a:apple:safari:8.0.0
    cpe:2.3:a:apple:safari:8.0.0
  • Apple Safari 8.0.1
    cpe:2.3:a:apple:safari:8.0.1
  • cpe:2.3:a:apple:safari:8.0.2
    cpe:2.3:a:apple:safari:8.0.2
  • cpe:2.3:a:apple:safari:8.0.3
    cpe:2.3:a:apple:safari:8.0.3
  • Apple iTunes 12.1
    cpe:2.3:a:apple:itunes:12.1
CVSS
Base: 6.8 (as of 28-07-2015 - 09:24)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SAFARI8_0_4.NASL
    description The version of Apple Safari installed on the remote Mac OS X host is prior to 6.2.4 / 7.1.4 / 8.0.4. It is, therefore, affected by multiple memory corruption vulnerabilities in WebKit due to improperly validated user-supplied input. A remote attacker, using a specially crafted website, can exploit these to execute arbitrary code. A flaw also exists related to user interface inconsistency that allows an attacker to conduct phishing attacks by spoofing the URL.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 81915
    published 2015-03-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81915
    title Mac OS X : Apple Safari < 6.2.4 / 7.1.4 / 8.0.4 Multiple Vulnerabilities
  • NASL family Windows
    NASL id ITUNES_12_2_0.NASL
    description The version of Apple iTunes installed on the remote Windows host is prior to 12.2. It is, therefore, affected by multiple vulnerabilities in the bundled version of WebKit, including denial of service and arbitrary code execution vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 84504
    published 2015-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84504
    title Apple iTunes < 12.2 Multiple Vulnerabilities (credentialed check)
  • NASL family Peer-To-Peer File Sharing
    NASL id ITUNES_12_2_0_BANNER.NASL
    description The version of Apple iTunes running on the remote host is prior to 12.2. It is, therefore, affected by multiple vulnerabilities due to memory corruption issues in the WebKit component. An attacker can exploit these to cause a denial of service or execute arbitrary code. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 86600
    published 2015-10-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86600
    title Apple iTunes < 12.2 Multiple Vulnerabilities (uncredentialed check)
refmap via4
apple
  • APPLE-SA-2015-03-17-1
  • APPLE-SA-2015-06-30-6
confirm
sectrack 1031936
Last major update 28-07-2015 - 11:16
Published 18-03-2015 - 18:59
Back to Top