var-201409-0505
Vulnerability from variot
WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and APPLE-SA-2014-09-17-2. Apple iOS and Apple TV Used in etc. WebKit is prone to multiple unspecified memory-corruption vulnerabilities. An attacker may exploit these issues by enticing victims into viewing a malicious webpage. Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. This BID is being retired. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2014-09-17-2 Apple TV 7
Apple TV 7 is now available and addresses the following:
Apple TV Available for: Apple TV 3rd generation and later Impact: An attacker can obtain WiFi credentials Description: An attacker could have impersonated a WiFi access point, offered to authenticate with LEAP, broken the MS-CHAPv1 hash, and used the derived credentials to authenticate to the intended access point even if that access point supported stronger authentication methods. This issue was addressed by removing support for LEAP. CVE-ID CVE-2014-4364 : Pieter Robyns, Bram Bonne, Peter Quax, and Wim Lamotte of Universiteit Hasselt
Apple TV Available for: Apple TV 3rd generation and later Impact: An attacker with access to an device may access sensitive user information from logs Description: Sensitive user information was logged. This issue was addressed by logging less information. CVE-ID CVE-2014-4357 : Heli Myllykoski of OP-Pohjola Group
Apple TV Available for: Apple TV 3rd generation and later Impact: An attacker with a privileged network position may be able to cause a device to think that it is up to date even when it is not Description: A validation issue existed in the handling of update check responses. Spoofed dates from Last-Modified response headers set to future dates were used for If-Modified-Since checks in subsequent update requests. This issue was addressed by validation of the Last-Modified header. CVE-ID CVE-2014-4383 : Raul Siles of DinoSec
Apple TV Available for: Apple TV 3rd generation and later Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in the handling of PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4377 : Felipe Andres Manzano of Binamuse VRT working with the iSIGHT Partners GVP Program
Apple TV Available for: Apple TV 3rd generation and later Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or an information disclosure Description: An out of bounds memory read existed in the handling of PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4378 : Felipe Andres Manzano of Binamuse VRT working with the iSIGHT Partners GVP Program
Apple TV Available for: Apple TV 3rd generation and later Impact: An application may cause an unexpected system termination Description: A null pointer dereference existed in the handling of IOAcceleratorFamily API arguments. This issue was addressed through improved validation of IOAcceleratorFamily API arguments. CVE-ID CVE-2014-4369 : Catherine aka winocm
Apple TV Available for: Apple TV 3rd generation and later Impact: The device may unexpectedly restart Description: A NULL pointer dereference was present in the IntelAccelerator driver. The issue was addressed by improved error handling. CVE-ID CVE-2014-4373 : cunzhang from Adlab of Venustech
Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to read kernel pointers, which can be used to bypass kernel address space layout randomization Description: An out-of-bounds read issue existed in the handling of an IOHIDFamily function. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4379 : Ian Beer of Google Project Zero
Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A heap buffer overflow existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4404 : Ian Beer of Google Project Zero
Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A null pointer dereference existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved validation of IOHIDFamily key-mapping properties. CVE-ID CVE-2014-4405 : Ian Beer of Google Project Zero
Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue existed in the IOHIDFamily kernel extension. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4380 : cunzhang from Adlab of Venustech
Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to read uninitialized data from kernel memory Description: An uninitialized memory access issue existed in the handling of IOKit functions. This issue was addressed through improved memory initialization CVE-ID CVE-2014-4407 : @PanguTeam
Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IODataQueue objects. This issue was addressed through improved validation of metadata. CVE-ID CVE-2014-4418 : Ian Beer of Google Project Zero
Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IODataQueue objects. This issue was addressed through improved validation of metadata. This issue was addressed through improved validation of IOKit API arguments. CVE-ID CVE-2014-4389 : Ian Beer of Google Project Zero
Apple TV Available for: Apple TV 3rd generation and later Impact: A local user may be able to determine kernel memory layout Description: Multiple uninitialized memory issues existed in the network statistics interface, which led to the disclosure of kernel memory content. This issue was addressed through additional memory initialization. CVE-ID CVE-2014-4371 : Fermin J. Serna of the Google Security Team
Apple TV Available for: Apple TV 3rd generation and later Impact: A person with a privileged network position may cause a denial of service Description: A race condition issue existed in the handling of IPv6 packets. This issue was addressed through improved lock state checking. CVE-ID CVE-2011-2391 : Marc Heuse
Apple TV Available for: Apple TV 3rd generation and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: A double free issue existed in the handling of Mach ports. This issue was addressed through improved validation of Mach ports. CVE-ID CVE-2014-4375
Apple TV Available for: Apple TV 3rd generation and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: An out-of-bounds read issue existed in rt_setgate. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4408
Apple TV Available for: Apple TV 3rd generation and later Impact: Some kernel hardening measures may be bypassed Description: The 'early' random number generator used in some kernel hardening measures was not cryptographically secure, and some of its output was exposed to user space, allowing bypass of the hardening measures. This issue was addressed by replacing the random number generator with a cryptographically secure algorithm, and using a 16-byte seed. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4381 : Ian Beer of Google Project Zero
Apple TV Available for: Apple TV 3rd generation and later Impact: A local user may be able to change permissions on arbitrary files Description: syslogd followed symbolic links while changing permissions on files. This issue was addressed through improved handling of symbolic links. These issues were addressed through improved memory handling. CVE-ID CVE-2013-6663 : Atte Kettunen of OUSPG CVE-2014-1384 : Apple CVE-2014-1385 : Apple CVE-2014-1387 : Google Chrome Security Team CVE-2014-1388 : Apple CVE-2014-1389 : Apple CVE-2014-4410 : Eric Seidel of Google CVE-2014-4411 : Google Chrome Security Team CVE-2014-4412 : Apple CVE-2014-4413 : Apple CVE-2014-4414 : Apple CVE-2014-4415 : Apple
Installation note:
Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> General -> Update Software".
To check the current version of software, select "Settings -> General -> About".
Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJUGMh1AAoJEBcWfLTuOo7tSWgP/j19RyvhyRDhJJyBozeK/pN6 6pgKhW3R++yi3COOjYX9oGmupiDNlIz5Rd7pkZMxq+f6BbwBh+hzXoPDdHw33yRO pQ9nV32gDIBlQRjvqmJgU/w6ODJWdPukcGBZqqjTjywce/tDxC9ZQBZLcRRuifXl dQdCYmXpkIcyZ3Yh9uF6sSXy0vngZr7kvvyJnst4WTmjqF3X9Sak75/s8Xa4oLyg naD+o2ITisuMk7dEmY6p1vqhbbQIxIeg315VyQxoGfsml9IPtOI5SWOPO+wi6nNd PyHKTFuhmlqjE+tKdBLulBMQPNreF0bCP+iNipBtAUS8RUyR19dfkDDjJeBbcqp7 Lsl4+6XsXABKPjrj66pBl7M7NZR+9mRfJbr83gmDN7hXu2OZJ7PxH49UKmr7JkeK OWlMyiyd4NfigtlasUTnom+Jky+uIDy/JYBGkumgoCG50cdt+BAQgb8CiPCS11LK OX0Ra4X8juRxh9TajQ+afx6r5Ma0Zdhj+ONzGJaTCCV+/NVjSKb/o+MfxlSiRYBN ot4R5cbQFHFDxcpMW+5S8EYt8mgUmn7oCxBm21mj9hzo9pqDVWTABaIUywI4+4n4 uWnZKxtit873cik8gE+NtbngtF3/q40n0Wvf3UzP6RTedl9g56wmjZ8NPvKWL8rE vHsGbux+Eb0CYjDTQqqS =98h5 -----END PGP SIGNATURE-----
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2014-09-17-4 Safari 6.2 and Safari 7.1
Safari 6.2 and Safari 7.1 are now available and address the following:
Safari Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5 Impact: An attacker with a privileged network position may intercept user credentials Description: Saved passwords were autofilled on http sites, on https sites with broken trust, and in iframes. This issue was addressed by restricting password autofill to the main frame of https sites with valid certificate chains. This was addressed by disabling access to the application cache when in private browsing mode. CVE-ID CVE-2014-4409 : Yosuke Hasegawa (NetAgent Co., Led.)
Safari 7.1 and Safari 6.2 may be obtained from the Mac App Store. ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2015-0002
Date reported : December 28, 2015 Advisory ID : WSA-2015-0002 Advisory URL : http://webkitgtk.org/security/WSA-2015-0002.html CVE identifiers : CVE-2013-6663, CVE-2014-1748, CVE-2014-3192, CVE-2014-4409, CVE-2014-4410, CVE-2014-4411, CVE-2014-4412, CVE-2014-4413, CVE-2014-4414, CVE-2014-4452, CVE-2014-4459, CVE-2014-4465, CVE-2014-4466, CVE-2014-4468, CVE-2014-4469, CVE-2014-4470, CVE-2014-4471, CVE-2014-4472, CVE-2014-4473, CVE-2014-4474, CVE-2014-4475, CVE-2014-4476, CVE-2014-4477, CVE-2014-4479, CVE-2015-1068, CVE-2015-1069, CVE-2015-1070, CVE-2015-1071, CVE-2015-1072, CVE-2015-1073, CVE-2015-1074, CVE-2015-1075, CVE-2015-1076, CVE-2015-1077, CVE-2015-1080, CVE-2015-1081, CVE-2015-1082, CVE-2015-1083, CVE-2015-1084, CVE-2015-1119, CVE-2015-1120, CVE-2015-1121, CVE-2015-1122, CVE-2015-1124, CVE-2015-1126, CVE-2015-1127, CVE-2015-1152, CVE-2015-1153, CVE-2015-1154, CVE-2015-1155, CVE-2015-1156, CVE-2015-2330, CVE-2015-3658, CVE-2015-3659, CVE-2015-3660, CVE-2015-3727, CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-3750, CVE-2015-3751, CVE-2015-3752, CVE-2015-3753, CVE-2015-3754, CVE-2015-3755, CVE-2015-5788, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5822, CVE-2015-5823, CVE-2015-5825, CVE-2015-5826, CVE-2015-5827, CVE-2015-5828, CVE-2015-5928, CVE-2015-5929, CVE-2015-5930, CVE-2015-5931, CVE-2015-7002, CVE-2015-7012, CVE-2015-7013, CVE-2015-7014, CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7102, CVE-2015-7103, CVE-2015-7104.
Several vulnerabilities were discovered on WebKitGTK+.
CVE-2013-6663 Versions affected: WebKitGTK+ before 2.4.0. Credit to Atte Kettunen of OUSPG. Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view.
CVE-2014-1748 Versions affected: WebKitGTK+ before 2.6.0. Credit to Jordan Milne. The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.
CVE-2014-3192 Versions affected: WebKitGTK+ before 2.6.3. Credit to cloudfuzzer.
CVE-2014-4409 Versions affected: WebKitGTK+ before 2.6.0. Credit to Yosuke Hasegawa (NetAgent Co., Led.).
CVE-2014-4410 Versions affected: WebKitGTK+ before 2.6.0. Credit to Eric Seidel of Google.
CVE-2014-4411 Versions affected: WebKitGTK+ before 2.6.0. Credit to Google Chrome Security Team.
CVE-2014-4412 Versions affected: WebKitGTK+ before 2.4.0.
CVE-2014-4413 Versions affected: WebKitGTK+ before 2.4.0.
CVE-2014-4414 Versions affected: WebKitGTK+ before 2.4.0.
CVE-2014-4452 Versions affected: WebKitGTK+ before 2.6.0. Credit to unknown.
CVE-2014-4459 Versions affected: WebKitGTK+ before 2.6.2. Credit to unknown.
CVE-2014-4465 Versions affected: WebKitGTK+ before 2.6.2. Credit to Rennie deGraaf of iSEC Partners. WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element.
CVE-2014-4466 Versions affected: WebKitGTK+ before 2.6.2.
CVE-2014-4468 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2014-4469 Versions affected: WebKitGTK+ before 2.6.4.
CVE-2014-4470 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2014-4471 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2014-4472 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2014-4473 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2014-4474 Versions affected: WebKitGTK+ before 2.6.2.
CVE-2014-4475 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2014-4476 Versions affected: WebKitGTK+ before 2.6.2.
CVE-2014-4477 Versions affected: WebKitGTK+ before 2.6.4. Credit to lokihardt@ASRT working with HP’s Zero Day Initiative.
CVE-2014-4479 Versions affected: WebKitGTK+ before 2.6.4.
CVE-2015-1068 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1069 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1070 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1071 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1072 Versions affected: WebKitGTK+ before 2.8.0. Credit to unknown.
CVE-2015-1073 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1074 Versions affected: WebKitGTK+ before 2.6.4.
CVE-2015-1075 Versions affected: WebKitGTK+ before 2.8.0. Credit to Google Chrome Security Team.
CVE-2015-1076 Versions affected: WebKitGTK+ before 2.8.0. Credit to unknown.
CVE-2015-1077 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1080 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2015-1081 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1082 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1083 Versions affected: WebKitGTK+ before 2.6.4.
CVE-2015-1084 Versions affected: WebKitGTK+ before 2.6.1. The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
CVE-2015-1119 Versions affected: WebKitGTK+ before 2.8.0. Credit to Renata Hodovan of University of Szeged / Samsung Electronics.
CVE-2015-1120 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1121 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1122 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-1124 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1126 Versions affected: WebKitGTK+ before 2.8.0. Credit to Jouko Pynnonen of Klikki Oy. WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.
CVE-2015-1127 Versions affected: WebKitGTK+ before 2.8.0. Credit to Tyler C (2.6.5). The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history into an index, which might allow local users to obtain sensitive information by reading index entries.
CVE-2015-1152 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-1153 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1154 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-1155 Versions affected: WebKitGTK+ before 2.10.0. Credit to Joe Vennix of Rapid7 Inc. working with HP's Zero Day Initiative.
CVE-2015-1156 Versions affected: WebKitGTK+ before 2.8.0. Credit to Zachary Durber of Moodle.
CVE-2015-2330 Versions affected: WebKitGTK+ before 2.6.6. Credit to Ross Lagerwall. Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
CVE-2015-3658 Versions affected: WebKitGTK+ before 2.8.1. Credit to Brad Hill of Facebook.
CVE-2015-3659 Versions affected: WebKitGTK+ before 2.8.3. Credit to Peter Rutenbar working with HP's Zero Day Initiative.
CVE-2015-3660 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-3727 Versions affected: WebKitGTK+ before 2.8.1. Credit to Peter Rutenbar working with HP's Zero Day Initiative.
CVE-2015-3730 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-3731 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3732 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3733 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3734 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3735 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3736 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3737 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3738 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-3739 Versions affected: WebKitGTK+ before 2.8.1.
CVE-2015-3740 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-3741 Versions affected: WebKitGTK+ before 2.8.1.
CVE-2015-3742 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-3743 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3744 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-3745 Versions affected: WebKitGTK+ before 2.8.1.
CVE-2015-3746 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-3747 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-3748 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3749 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-3750 Versions affected: WebKitGTK+ before 2.10.0. Credit to Muneaki Nishimura (nishimunea). WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client- server data stream.
CVE-2015-3751 Versions affected: WebKitGTK+ before 2.10.0. Credit to Muneaki Nishimura (nishimunea). WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element.
CVE-2015-3752 Versions affected: WebKitGTK+ before 2.8.4. Credit to Muneaki Nishimura (nishimunea). The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross- origin request or (2) a private-browsing request.
CVE-2015-3753 Versions affected: WebKitGTK+ before 2.8.3. Credit to Antonio Sanso and Damien Antipa of Adobe. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
CVE-2015-3754 Versions affected: WebKitGTK+ before 2.10.0. Credit to Dongsung Kim (@kid1ng).
CVE-2015-3755 Versions affected: WebKitGTK+ before 2.10.0. Credit to xisigr of Tencent's Xuanwu Lab. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.
CVE-2015-5788 Versions affected: WebKitGTK+ before 2.8.0. The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element.
CVE-2015-5789 Versions affected: WebKitGTK+ before 2.6.1.
CVE-2015-5790 Versions affected: WebKitGTK+ before 2.6.2.
CVE-2015-5791 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2015-5792 Versions affected: WebKitGTK+ before 2.4.0.
CVE-2015-5793 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5794 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5795 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-5797 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5798 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2015-5799 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5800 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5801 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5802 Versions affected: WebKitGTK+ before 2.6.0.
CVE-2015-5803 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5804 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5805 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown.
CVE-2015-5806 Versions affected: WebKitGTK+ before 2.8.3.
CVE-2015-5807 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5809 Versions affected: WebKitGTK+ before 2.8.4.
CVE-2015-5810 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5811 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5812 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5813 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5814 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5815 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5816 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5817 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5818 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5819 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5822 Versions affected: WebKitGTK+ before 2.8.1. Credit to Mark S. Miller of Google.
CVE-2015-5823 Versions affected: WebKitGTK+ before 2.8.0.
CVE-2015-5825 Versions affected: WebKitGTK+ before 2.10.0. Credit to Yossi Oren et al. of Columbia University's Network Security Lab.
CVE-2015-5826 Versions affected: WebKitGTK+ before 2.6.5. Credit to filedescriptior, Chris Evans.
CVE-2015-5827 Versions affected: WebKitGTK+ before 2.10.0. Credit to Gildas. WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.
CVE-2015-5828 Versions affected: WebKitGTK+ before 2.10.0. Credit to Lorenzo Fontana.
CVE-2015-5928 Versions affected: WebKitGTK+ before 2.8.4.
CVE-2015-5929 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5930 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-5931 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown.
CVE-2015-7002 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-7012 Versions affected: WebKitGTK+ before 2.8.4.
CVE-2015-7013 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-7014 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown.
CVE-2015-7048 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-7095 Versions affected: WebKitGTK+ before 2.10.2.
CVE-2015-7097 Versions affected: WebKitGTK+ before 2.10.3.
CVE-2015-7099 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-7100 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-7102 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-7103 Versions affected: WebKitGTK+ before 2.10.0.
CVE-2015-7104 Versions affected: WebKitGTK+ before 2.10.0.
We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases.
Further information about WebKitGTK+ Security Advisories can be found at: http://webkitgtk.org/security.html
The WebKitGTK+ team, December 28, 2015
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0505",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.1.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.1"
},
{
"model": "tvos",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "6.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.0"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.0.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.1"
},
{
"model": "mac os x",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "10.9.4"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.5"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.6"
},
{
"model": "iphone os",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.1.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.1.2"
},
{
"model": "tv",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7 (apple tv first 3 after generation )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8 (ipad 2 or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8 (iphone 4s or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8 (ipod touch first 5 after generation )"
},
{
"model": "itunes",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.0.1 (windows)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "6.2 (os x mavericks 10.9.5)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "6.2 (os x mountain lion 10.8.5)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.1 (os x mavericks 10.9.5)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.1 (os x mountain lion 10.8.5)"
},
{
"model": "open source project webkit",
"scope": "eq",
"trust": 0.6,
"vendor": "webkit",
"version": "0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "0"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "5.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "2.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "2.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.0.2"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.1.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.1.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.9.4"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.1"
},
{
"model": "esignal",
"scope": "eq",
"trust": 0.3,
"vendor": "esignal",
"version": "6.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.6"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.5"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.7"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.5"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.5.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1.8"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.3.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.3.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.3"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.7"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.5"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.72"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.0.2.20"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.4"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.6"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.5"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.4"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0"
}
],
"sources": [
{
"db": "BID",
"id": "69881"
},
{
"db": "BID",
"id": "69966"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-639"
},
{
"db": "NVD",
"id": "CVE-2014-4410"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apple:apple_tv",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:itunes",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:safari",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Eric Seidel of Google, Google Chrome Security Team and Apple.",
"sources": [
{
"db": "BID",
"id": "69881"
}
],
"trust": 0.3
},
"cve": "CVE-2014-4410",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2014-4410",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-72350",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-4410",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-4410",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-639",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-72350",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72350"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-639"
},
{
"db": "NVD",
"id": "CVE-2014-4410"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and APPLE-SA-2014-09-17-2. Apple iOS and Apple TV Used in etc. WebKit is prone to multiple unspecified memory-corruption vulnerabilities. \nAn attacker may exploit these issues by enticing victims into viewing a malicious webpage. \nSuccessful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. \nThis BID is being retired. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2014-09-17-2 Apple TV 7\n\nApple TV 7 is now available and addresses the following:\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: An attacker can obtain WiFi credentials\nDescription: An attacker could have impersonated a WiFi access\npoint, offered to authenticate with LEAP, broken the MS-CHAPv1 hash,\nand used the derived credentials to authenticate to the intended\naccess point even if that access point supported stronger\nauthentication methods. This issue was addressed by removing support\nfor LEAP. \nCVE-ID\nCVE-2014-4364 : Pieter Robyns, Bram Bonne, Peter Quax, and Wim\nLamotte of Universiteit Hasselt\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: An attacker with access to an device may access sensitive\nuser information from logs\nDescription: Sensitive user information was logged. This issue was\naddressed by logging less information. \nCVE-ID\nCVE-2014-4357 : Heli Myllykoski of OP-Pohjola Group\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: An attacker with a privileged network position may be able\nto cause a device to think that it is up to date even when it is not\nDescription: A validation issue existed in the handling of update\ncheck responses. Spoofed dates from Last-Modified response headers\nset to future dates were used for If-Modified-Since checks in\nsubsequent update requests. This issue was addressed by validation of\nthe Last-Modified header. \nCVE-ID\nCVE-2014-4383 : Raul Siles of DinoSec\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: Opening a maliciously crafted PDF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An integer overflow existed in the handling of PDF\nfiles. This issue was addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4377 : Felipe Andres Manzano of Binamuse VRT working with\nthe iSIGHT Partners GVP Program\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: Opening a maliciously crafted PDF file may lead to an\nunexpected application termination or an information disclosure\nDescription: An out of bounds memory read existed in the handling of\nPDF files. This issue was addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4378 : Felipe Andres Manzano of Binamuse VRT working with\nthe iSIGHT Partners GVP Program\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: An application may cause an unexpected system termination\nDescription: A null pointer dereference existed in the handling of\nIOAcceleratorFamily API arguments. This issue was addressed through\nimproved validation of IOAcceleratorFamily API arguments. \nCVE-ID\nCVE-2014-4369 : Catherine aka winocm\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: The device may unexpectedly restart\nDescription: A NULL pointer dereference was present in the\nIntelAccelerator driver. The issue was addressed by improved error\nhandling. \nCVE-ID\nCVE-2014-4373 : cunzhang from Adlab of Venustech\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A malicious application may be able to read kernel pointers,\nwhich can be used to bypass kernel address space layout randomization\nDescription: An out-of-bounds read issue existed in the handling of\nan IOHIDFamily function. This issue was addressed through improved\nbounds checking. \nCVE-ID\nCVE-2014-4379 : Ian Beer of Google Project Zero\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A heap buffer overflow existed in IOHIDFamily\u0027s\nhandling of key-mapping properties. This issue was addressed through\nimproved bounds checking. \nCVE-ID\nCVE-2014-4404 : Ian Beer of Google Project Zero\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A null pointer dereference existed in IOHIDFamily\u0027s\nhandling of key-mapping properties. This issue was addressed through\nimproved validation of IOHIDFamily key-mapping properties. \nCVE-ID\nCVE-2014-4405 : Ian Beer of Google Project Zero\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A malicious application may be able to execute arbitrary\ncode with kernel privileges\nDescription: An out-of-bounds write issue existed in the IOHIDFamily\nkernel extension. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2014-4380 : cunzhang from Adlab of Venustech\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A malicious application may be able to read uninitialized\ndata from kernel memory\nDescription: An uninitialized memory access issue existed in the\nhandling of IOKit functions. This issue was addressed through\nimproved memory initialization\nCVE-ID\nCVE-2014-4407 : @PanguTeam\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A validation issue existed in the handling of certain\nmetadata fields of IODataQueue objects. This issue was addressed\nthrough improved validation of metadata. \nCVE-ID\nCVE-2014-4418 : Ian Beer of Google Project Zero\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A validation issue existed in the handling of certain\nmetadata fields of IODataQueue objects. This issue was addressed\nthrough improved validation of metadata. This issue was addressed through improved validation of\nIOKit API arguments. \nCVE-ID\nCVE-2014-4389 : Ian Beer of Google Project Zero\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A local user may be able to determine kernel memory layout\nDescription: Multiple uninitialized memory issues existed in the\nnetwork statistics interface, which led to the disclosure of kernel\nmemory content. This issue was addressed through additional memory\ninitialization. \nCVE-ID\nCVE-2014-4371 : Fermin J. Serna of the Google Security Team\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A person with a privileged network position may cause a\ndenial of service\nDescription: A race condition issue existed in the handling of IPv6\npackets. This issue was addressed through improved lock state\nchecking. \nCVE-ID\nCVE-2011-2391 : Marc Heuse\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A local user may be able to cause an unexpected system\ntermination or arbitrary code execution in the kernel\nDescription: A double free issue existed in the handling of Mach\nports. This issue was addressed through improved validation of Mach\nports. \nCVE-ID\nCVE-2014-4375\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A local user may be able to cause an unexpected system\ntermination or arbitrary code execution in the kernel\nDescription: An out-of-bounds read issue existed in rt_setgate. This issue was\naddressed through improved bounds checking. \nCVE-ID\nCVE-2014-4408\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: Some kernel hardening measures may be bypassed\nDescription: The \u0027early\u0027 random number generator used in some kernel\nhardening measures was not cryptographically secure, and some of its\noutput was exposed to user space, allowing bypass of the hardening\nmeasures. This issue was addressed by replacing the random number\ngenerator with a cryptographically secure algorithm, and using a\n16-byte seed. This\nissue was addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4381 : Ian Beer of Google Project Zero\n\nApple TV\nAvailable for: Apple TV 3rd generation and later\nImpact: A local user may be able to change permissions on arbitrary\nfiles\nDescription: syslogd followed symbolic links while changing\npermissions on files. This issue was addressed through improved\nhandling of symbolic links. \nThese issues were addressed through improved memory handling. \nCVE-ID\nCVE-2013-6663 : Atte Kettunen of OUSPG\nCVE-2014-1384 : Apple\nCVE-2014-1385 : Apple\nCVE-2014-1387 : Google Chrome Security Team\nCVE-2014-1388 : Apple\nCVE-2014-1389 : Apple\nCVE-2014-4410 : Eric Seidel of Google\nCVE-2014-4411 : Google Chrome Security Team\nCVE-2014-4412 : Apple\nCVE-2014-4413 : Apple\nCVE-2014-4414 : Apple\nCVE-2014-4415 : Apple\n\n\nInstallation note:\n\nApple TV will periodically check for software updates. Alternatively,\nyou may manually check for software updates by selecting\n\"Settings -\u003e General -\u003e Update Software\". \n\nTo check the current version of software, select\n\"Settings -\u003e General -\u003e About\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.22 (Darwin)\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBAgAGBQJUGMh1AAoJEBcWfLTuOo7tSWgP/j19RyvhyRDhJJyBozeK/pN6\n6pgKhW3R++yi3COOjYX9oGmupiDNlIz5Rd7pkZMxq+f6BbwBh+hzXoPDdHw33yRO\npQ9nV32gDIBlQRjvqmJgU/w6ODJWdPukcGBZqqjTjywce/tDxC9ZQBZLcRRuifXl\ndQdCYmXpkIcyZ3Yh9uF6sSXy0vngZr7kvvyJnst4WTmjqF3X9Sak75/s8Xa4oLyg\nnaD+o2ITisuMk7dEmY6p1vqhbbQIxIeg315VyQxoGfsml9IPtOI5SWOPO+wi6nNd\nPyHKTFuhmlqjE+tKdBLulBMQPNreF0bCP+iNipBtAUS8RUyR19dfkDDjJeBbcqp7\nLsl4+6XsXABKPjrj66pBl7M7NZR+9mRfJbr83gmDN7hXu2OZJ7PxH49UKmr7JkeK\nOWlMyiyd4NfigtlasUTnom+Jky+uIDy/JYBGkumgoCG50cdt+BAQgb8CiPCS11LK\nOX0Ra4X8juRxh9TajQ+afx6r5Ma0Zdhj+ONzGJaTCCV+/NVjSKb/o+MfxlSiRYBN\not4R5cbQFHFDxcpMW+5S8EYt8mgUmn7oCxBm21mj9hzo9pqDVWTABaIUywI4+4n4\nuWnZKxtit873cik8gE+NtbngtF3/q40n0Wvf3UzP6RTedl9g56wmjZ8NPvKWL8rE\nvHsGbux+Eb0CYjDTQqqS\n=98h5\n-----END PGP SIGNATURE-----\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2014-09-17-4 Safari 6.2 and Safari 7.1\n\nSafari 6.2 and Safari 7.1 are now available and address the\nfollowing:\n\nSafari\nAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5\nImpact: An attacker with a privileged network position may intercept\nuser credentials\nDescription: Saved passwords were autofilled on http sites, on https\nsites with broken trust, and in iframes. This issue was addressed by\nrestricting password autofill to the main frame of https sites with\nvalid certificate chains. This was addressed by disabling access to the application\ncache when in private browsing mode. \nCVE-ID\nCVE-2014-4409 : Yosuke Hasegawa (NetAgent Co., Led.)\n\n\nSafari 7.1 and Safari 6.2 may be obtained from the Mac App Store. ------------------------------------------------------------------------\nWebKitGTK+ Security Advisory WSA-2015-0002\n------------------------------------------------------------------------\n\nDate reported : December 28, 2015\nAdvisory ID : WSA-2015-0002\nAdvisory URL : http://webkitgtk.org/security/WSA-2015-0002.html\nCVE identifiers : CVE-2013-6663, CVE-2014-1748, CVE-2014-3192,\n CVE-2014-4409, CVE-2014-4410, CVE-2014-4411,\n CVE-2014-4412, CVE-2014-4413, CVE-2014-4414,\n CVE-2014-4452, CVE-2014-4459, CVE-2014-4465,\n CVE-2014-4466, CVE-2014-4468, CVE-2014-4469,\n CVE-2014-4470, CVE-2014-4471, CVE-2014-4472,\n CVE-2014-4473, CVE-2014-4474, CVE-2014-4475,\n CVE-2014-4476, CVE-2014-4477, CVE-2014-4479,\n CVE-2015-1068, CVE-2015-1069, CVE-2015-1070,\n CVE-2015-1071, CVE-2015-1072, CVE-2015-1073,\n CVE-2015-1074, CVE-2015-1075, CVE-2015-1076,\n CVE-2015-1077, CVE-2015-1080, CVE-2015-1081,\n CVE-2015-1082, CVE-2015-1083, CVE-2015-1084,\n CVE-2015-1119, CVE-2015-1120, CVE-2015-1121,\n CVE-2015-1122, CVE-2015-1124, CVE-2015-1126,\n CVE-2015-1127, CVE-2015-1152, CVE-2015-1153,\n CVE-2015-1154, CVE-2015-1155, CVE-2015-1156,\n CVE-2015-2330, CVE-2015-3658, CVE-2015-3659,\n CVE-2015-3660, CVE-2015-3727, CVE-2015-3730,\n CVE-2015-3731, CVE-2015-3732, CVE-2015-3733,\n CVE-2015-3734, CVE-2015-3735, CVE-2015-3736,\n CVE-2015-3737, CVE-2015-3738, CVE-2015-3739,\n CVE-2015-3740, CVE-2015-3741, CVE-2015-3742,\n CVE-2015-3743, CVE-2015-3744, CVE-2015-3745,\n CVE-2015-3746, CVE-2015-3747, CVE-2015-3748,\n CVE-2015-3749, CVE-2015-3750, CVE-2015-3751,\n CVE-2015-3752, CVE-2015-3753, CVE-2015-3754,\n CVE-2015-3755, CVE-2015-5788, CVE-2015-5789,\n CVE-2015-5790, CVE-2015-5791, CVE-2015-5792,\n CVE-2015-5793, CVE-2015-5794, CVE-2015-5795,\n CVE-2015-5797, CVE-2015-5798, CVE-2015-5799,\n CVE-2015-5800, CVE-2015-5801, CVE-2015-5802,\n CVE-2015-5803, CVE-2015-5804, CVE-2015-5805,\n CVE-2015-5806, CVE-2015-5807, CVE-2015-5809,\n CVE-2015-5810, CVE-2015-5811, CVE-2015-5812,\n CVE-2015-5813, CVE-2015-5814, CVE-2015-5815,\n CVE-2015-5816, CVE-2015-5817, CVE-2015-5818,\n CVE-2015-5819, CVE-2015-5822, CVE-2015-5823,\n CVE-2015-5825, CVE-2015-5826, CVE-2015-5827,\n CVE-2015-5828, CVE-2015-5928, CVE-2015-5929,\n CVE-2015-5930, CVE-2015-5931, CVE-2015-7002,\n CVE-2015-7012, CVE-2015-7013, CVE-2015-7014,\n CVE-2015-7048, CVE-2015-7095, CVE-2015-7097,\n CVE-2015-7099, CVE-2015-7100, CVE-2015-7102,\n CVE-2015-7103, CVE-2015-7104. \n\nSeveral vulnerabilities were discovered on WebKitGTK+. \n\nCVE-2013-6663\n Versions affected: WebKitGTK+ before 2.4.0. \n Credit to Atte Kettunen of OUSPG. \n Use-after-free vulnerability in the SVGImage::setContainerSize\n function in core/svg/graphics/SVGImage.cpp in the SVG implementation\n in Blink, as used in Google Chrome before 33.0.1750.146, allows\n remote attackers to cause a denial of service or possibly have\n unspecified other impact via vectors related to the resizing of a\n view. \n\nCVE-2014-1748\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Jordan Milne. \n The ScrollView::paint function in platform/scroll/ScrollView.cpp in\n Blink, as used in Google Chrome before 35.0.1916.114, allows remote\n attackers to spoof the UI by extending scrollbar painting into the\n parent frame. \n\nCVE-2014-3192\n Versions affected: WebKitGTK+ before 2.6.3. \n Credit to cloudfuzzer. \n\nCVE-2014-4409\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Yosuke Hasegawa (NetAgent Co., Led.). \n\nCVE-2014-4410\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Eric Seidel of Google. \n\nCVE-2014-4411\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Google Chrome Security Team. \n\nCVE-2014-4412\n Versions affected: WebKitGTK+ before 2.4.0. \n\nCVE-2014-4413\n Versions affected: WebKitGTK+ before 2.4.0. \n\nCVE-2014-4414\n Versions affected: WebKitGTK+ before 2.4.0. \n\nCVE-2014-4452\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to unknown. \n\nCVE-2014-4459\n Versions affected: WebKitGTK+ before 2.6.2. \n Credit to unknown. \n\nCVE-2014-4465\n Versions affected: WebKitGTK+ before 2.6.2. \n Credit to Rennie deGraaf of iSEC Partners. \n WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x\n before 8.0.1 allows remote attackers to bypass the Same Origin\n Policy via crafted Cascading Style Sheets (CSS) token sequences\n within an SVG file in the SRC attribute of an IMG element. \n\nCVE-2014-4466\n Versions affected: WebKitGTK+ before 2.6.2. \n\nCVE-2014-4468\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2014-4469\n Versions affected: WebKitGTK+ before 2.6.4. \n\nCVE-2014-4470\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2014-4471\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2014-4472\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2014-4473\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2014-4474\n Versions affected: WebKitGTK+ before 2.6.2. \n\nCVE-2014-4475\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2014-4476\n Versions affected: WebKitGTK+ before 2.6.2. \n\nCVE-2014-4477\n Versions affected: WebKitGTK+ before 2.6.4. \n Credit to lokihardt@ASRT working with HP\u2019s Zero Day Initiative. \n\nCVE-2014-4479\n Versions affected: WebKitGTK+ before 2.6.4. \n\nCVE-2015-1068\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1069\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1070\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1071\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1072\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to unknown. \n\nCVE-2015-1073\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1074\n Versions affected: WebKitGTK+ before 2.6.4. \n\nCVE-2015-1075\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Google Chrome Security Team. \n\nCVE-2015-1076\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to unknown. \n\nCVE-2015-1077\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1080\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2015-1081\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1082\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1083\n Versions affected: WebKitGTK+ before 2.6.4. \n\nCVE-2015-1084\n Versions affected: WebKitGTK+ before 2.6.1. \n The user interface in WebKit, as used in Apple Safari before 6.2.4,\n 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs\n consistently, which makes it easier for remote attackers to conduct\n phishing attacks via a crafted URL. \n\nCVE-2015-1119\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Renata Hodovan of University of Szeged / Samsung\n Electronics. \n\nCVE-2015-1120\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1121\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1122\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-1124\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1126\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Jouko Pynnonen of Klikki Oy. \n WebKit, as used in Apple iOS before 8.3 and Apple Safari before\n 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly\n handle the userinfo field in FTP URLs, which allows remote attackers\n to trigger incorrect resource access via unspecified vectors. \n\nCVE-2015-1127\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Tyler C (2.6.5). \n The private-browsing implementation in WebKit in Apple Safari before\n 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing\n history into an index, which might allow local users to obtain\n sensitive information by reading index entries. \n\nCVE-2015-1152\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-1153\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1154\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-1155\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Joe Vennix of Rapid7 Inc. working with HP\u0027s Zero Day\n Initiative. \n\nCVE-2015-1156\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Zachary Durber of Moodle. \n\nCVE-2015-2330\n Versions affected: WebKitGTK+ before 2.6.6. \n Credit to Ross Lagerwall. \n Late TLS certificate verification in WebKitGTK+ prior to 2.6.6\n allows remote attackers to view a secure HTTP request, including,\n for example, secure cookies. \n\nCVE-2015-3658\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Brad Hill of Facebook. \n\nCVE-2015-3659\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Peter Rutenbar working with HP\u0027s Zero Day Initiative. \n\nCVE-2015-3660\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-3727\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Peter Rutenbar working with HP\u0027s Zero Day Initiative. \n\nCVE-2015-3730\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-3731\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3732\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3733\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3734\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3735\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3736\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3737\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3738\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-3739\n Versions affected: WebKitGTK+ before 2.8.1. \n\nCVE-2015-3740\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-3741\n Versions affected: WebKitGTK+ before 2.8.1. \n\nCVE-2015-3742\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-3743\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3744\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-3745\n Versions affected: WebKitGTK+ before 2.8.1. \n\nCVE-2015-3746\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-3747\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-3748\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3749\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-3750\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Muneaki Nishimura (nishimunea). \n WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x\n before 8.0.8, as used in iOS before 8.4.1 and other products, does\n not enforce the HTTP Strict Transport Security (HSTS) protection\n mechanism for Content Security Policy (CSP) report requests, which\n allows man-in-the-middle attackers to obtain sensitive information\n by sniffing the network or spoof a report by modifying the client-\n server data stream. \n\nCVE-2015-3751\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Muneaki Nishimura (nishimunea). \n WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x\n before 8.0.8, as used in iOS before 8.4.1 and other products, allows\n remote attackers to bypass a Content Security Policy protection\n mechanism by using a video control in conjunction with an IMG\n element within an OBJECT element. \n\nCVE-2015-3752\n Versions affected: WebKitGTK+ before 2.8.4. \n Credit to Muneaki Nishimura (nishimunea). \n The Content Security Policy implementation in WebKit in Apple Safari\n before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS\n before 8.4.1 and other products, does not properly restrict cookie\n transmission for report requests, which allows remote attackers to\n obtain sensitive information via vectors involving (1) a cross-\n origin request or (2) a private-browsing request. \n\nCVE-2015-3753\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Antonio Sanso and Damien Antipa of Adobe. \n WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x\n before 8.0.8, as used in iOS before 8.4.1 and other products, does\n not properly perform taint checking for CANVAS elements, which\n allows remote attackers to bypass the Same Origin Policy and obtain\n sensitive image data by leveraging a redirect to a data:image\n resource. \n\nCVE-2015-3754\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Dongsung Kim (@kid1ng). \n\nCVE-2015-3755\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to xisigr of Tencent\u0027s Xuanwu Lab. \n WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x\n before 8.0.8, as used in iOS before 8.4.1 and other products, allows\n remote attackers to spoof the user interface via a malformed URL. \n\nCVE-2015-5788\n Versions affected: WebKitGTK+ before 2.8.0. \n The WebKit Canvas implementation in Apple iOS before 9 allows remote\n attackers to bypass the Same Origin Policy and obtain sensitive\n image information via vectors involving a CANVAS element. \n\nCVE-2015-5789\n Versions affected: WebKitGTK+ before 2.6.1. \n\nCVE-2015-5790\n Versions affected: WebKitGTK+ before 2.6.2. \n\nCVE-2015-5791\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2015-5792\n Versions affected: WebKitGTK+ before 2.4.0. \n\nCVE-2015-5793\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5794\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5795\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-5797\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5798\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2015-5799\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5800\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5801\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5802\n Versions affected: WebKitGTK+ before 2.6.0. \n\nCVE-2015-5803\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5804\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5805\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to unknown. \n\nCVE-2015-5806\n Versions affected: WebKitGTK+ before 2.8.3. \n\nCVE-2015-5807\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5809\n Versions affected: WebKitGTK+ before 2.8.4. \n\nCVE-2015-5810\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5811\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5812\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5813\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5814\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5815\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5816\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5817\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5818\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5819\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5822\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Mark S. Miller of Google. \n\nCVE-2015-5823\n Versions affected: WebKitGTK+ before 2.8.0. \n\nCVE-2015-5825\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Yossi Oren et al. of Columbia University\u0027s Network\n Security Lab. \n\nCVE-2015-5826\n Versions affected: WebKitGTK+ before 2.6.5. \n Credit to filedescriptior, Chris Evans. \n\nCVE-2015-5827\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Gildas. \n WebKit in Apple iOS before 9 allows remote attackers to bypass the\n Same Origin Policy and obtain an object reference via vectors\n involving a (1) custom event, (2) message event, or (3) pop state\n event. \n\nCVE-2015-5828\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Lorenzo Fontana. \n\nCVE-2015-5928\n Versions affected: WebKitGTK+ before 2.8.4. \n\nCVE-2015-5929\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5930\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-5931\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to unknown. \n\nCVE-2015-7002\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-7012\n Versions affected: WebKitGTK+ before 2.8.4. \n\nCVE-2015-7013\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-7014\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to unknown. \n\nCVE-2015-7048\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-7095\n Versions affected: WebKitGTK+ before 2.10.2. \n\nCVE-2015-7097\n Versions affected: WebKitGTK+ before 2.10.3. \n\nCVE-2015-7099\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-7100\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-7102\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-7103\n Versions affected: WebKitGTK+ before 2.10.0. \n\nCVE-2015-7104\n Versions affected: WebKitGTK+ before 2.10.0. \n\n\nWe recommend updating to the last stable version of WebKitGTK+. It is\nthe best way of ensuring that you are running a safe version of\nWebKitGTK+. Please check our website for information about the last\nstable releases. \n\nFurther information about WebKitGTK+ Security Advisories can be found\nat: http://webkitgtk.org/security.html\n\nThe WebKitGTK+ team,\nDecember 28, 2015\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-4410"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"db": "BID",
"id": "69881"
},
{
"db": "BID",
"id": "69966"
},
{
"db": "VULHUB",
"id": "VHN-72350"
},
{
"db": "PACKETSTORM",
"id": "128299"
},
{
"db": "PACKETSTORM",
"id": "128316"
},
{
"db": "PACKETSTORM",
"id": "135081"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-4410",
"trust": 3.1
},
{
"db": "BID",
"id": "69966",
"trust": 2.0
},
{
"db": "BID",
"id": "69881",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "61306",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "61318",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1030866",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU93868849",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU97537282",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004317",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201409-639",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-72350",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "128299",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "128316",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135081",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72350"
},
{
"db": "BID",
"id": "69881"
},
{
"db": "BID",
"id": "69966"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"db": "PACKETSTORM",
"id": "128299"
},
{
"db": "PACKETSTORM",
"id": "128316"
},
{
"db": "PACKETSTORM",
"id": "135081"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-639"
},
{
"db": "NVD",
"id": "CVE-2014-4410"
}
]
},
"id": "VAR-201409-0505",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-72350"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:30:12.723000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT6441",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT6441"
},
{
"title": "HT6442",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT6442"
},
{
"title": "HT6537",
"trust": 0.8,
"url": "http://support.apple.com/en-eu/HT6537"
},
{
"title": "HT6440",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT6440"
},
{
"title": "HT6440",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT6440?viewlocale=ja_JP"
},
{
"title": "HT6441",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT6441?viewlocale=ja_JP"
},
{
"title": "HT6442",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT6442?viewlocale=ja_JP"
},
{
"title": "HT6537",
"trust": 0.8,
"url": "http://support.apple.com/ja-jp/HT6537"
},
{
"title": "AppleTV3,2_7.0_12A365b_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51554"
},
{
"title": "iPhone7,2_8.0_12A365_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51553"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-639"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72350"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"db": "NVD",
"id": "CVE-2014-4410"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"trust": 2.5,
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html"
},
{
"trust": 2.0,
"url": "http://support.apple.com/kb/ht6440"
},
{
"trust": 2.0,
"url": "http://support.apple.com/kb/ht6441"
},
{
"trust": 2.0,
"url": "http://support.apple.com/kb/ht6442"
},
{
"trust": 2.0,
"url": "https://support.apple.com/kb/ht6537"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/69881"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/69966"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id/1030866"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/61306"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/61318"
},
{
"trust": 1.7,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96030"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4410"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu93868849/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97537282/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4410"
},
{
"trust": 0.6,
"url": "http://www.webkit.org/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ios/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/safari/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-6663"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4411"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4410"
},
{
"trust": 0.2,
"url": "http://support.apple.com/kb/ht1222"
},
{
"trust": 0.2,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.2,
"url": "http://gpgtools.org"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4413"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4412"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4409"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4414"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1388"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4378"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4408"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4380"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1387"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4383"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4379"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4377"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4381"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4369"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1389"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4405"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4372"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2391"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4388"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1385"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4357"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4404"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4373"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4364"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4389"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1384"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4375"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4371"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4415"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4363"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4479"
},
{
"trust": 0.1,
"url": "http://webkitgtk.org/security.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1069"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4452"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4471"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4473"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4468"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4475"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1070"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1071"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4476"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1748"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4474"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3192"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4459"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4465"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4469"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4472"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4477"
},
{
"trust": 0.1,
"url": "http://webkitgtk.org/security/wsa-2015-0002.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4470"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1068"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4466"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72350"
},
{
"db": "BID",
"id": "69881"
},
{
"db": "BID",
"id": "69966"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"db": "PACKETSTORM",
"id": "128299"
},
{
"db": "PACKETSTORM",
"id": "128316"
},
{
"db": "PACKETSTORM",
"id": "135081"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-639"
},
{
"db": "NVD",
"id": "CVE-2014-4410"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-72350"
},
{
"db": "BID",
"id": "69881"
},
{
"db": "BID",
"id": "69966"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"db": "PACKETSTORM",
"id": "128299"
},
{
"db": "PACKETSTORM",
"id": "128316"
},
{
"db": "PACKETSTORM",
"id": "135081"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-639"
},
{
"db": "NVD",
"id": "CVE-2014-4410"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-09-18T00:00:00",
"db": "VULHUB",
"id": "VHN-72350"
},
{
"date": "2014-09-17T00:00:00",
"db": "BID",
"id": "69881"
},
{
"date": "2014-09-17T00:00:00",
"db": "BID",
"id": "69966"
},
{
"date": "2014-09-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"date": "2014-09-17T22:29:54",
"db": "PACKETSTORM",
"id": "128299"
},
{
"date": "2014-09-19T15:29:45",
"db": "PACKETSTORM",
"id": "128316"
},
{
"date": "2015-12-28T22:22:22",
"db": "PACKETSTORM",
"id": "135081"
},
{
"date": "2014-09-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-639"
},
{
"date": "2014-09-18T10:55:10.063000",
"db": "NVD",
"id": "CVE-2014-4410"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-72350"
},
{
"date": "2016-01-12T02:15:00",
"db": "BID",
"id": "69881"
},
{
"date": "2015-03-19T08:38:00",
"db": "BID",
"id": "69966"
},
{
"date": "2014-11-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004317"
},
{
"date": "2019-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-639"
},
{
"date": "2024-11-21T02:10:08.183000",
"db": "NVD",
"id": "CVE-2014-4410"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "69881"
},
{
"db": "BID",
"id": "69966"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple iOS and Apple TV Used in etc. WebKit Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-004317"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "69881"
},
{
"db": "BID",
"id": "69966"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.