var-201411-0271
Vulnerability from variot
Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attackers to execute arbitrary code via crafted page objects in an HTML document. Apple OS X Used in etc. Webkit Use freed memory (Use-after-free) May allow arbitrary code execution vulnerabilities. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. WebKit is prone to an unspecified memory-corruption vulnerability. An attacker may exploit this issue by enticing victims into viewing a malicious webpage. Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2015-0002
Date reported : December 28, 2015 Advisory ID : WSA-2015-0002 Advisory URL : http://webkitgtk.org/security/WSA-2015-0002.html CVE identifiers : CVE-2013-6663, CVE-2014-1748, CVE-2014-3192, CVE-2014-4409, CVE-2014-4410, CVE-2014-4411, CVE-2014-4412, CVE-2014-4413, CVE-2014-4414, CVE-2014-4452, CVE-2014-4459, CVE-2014-4465, CVE-2014-4466, CVE-2014-4468, CVE-2014-4469, CVE-2014-4470, CVE-2014-4471, CVE-2014-4472, CVE-2014-4473, CVE-2014-4474, CVE-2014-4475, CVE-2014-4476, CVE-2014-4477, CVE-2014-4479, CVE-2015-1068, CVE-2015-1069, CVE-2015-1070, CVE-2015-1071, CVE-2015-1072, CVE-2015-1073, CVE-2015-1074, CVE-2015-1075, CVE-2015-1076, CVE-2015-1077, CVE-2015-1080, CVE-2015-1081, CVE-2015-1082, CVE-2015-1083, CVE-2015-1084, CVE-2015-1119, CVE-2015-1120, CVE-2015-1121, CVE-2015-1122, CVE-2015-1124, CVE-2015-1126, CVE-2015-1127, CVE-2015-1152, CVE-2015-1153, CVE-2015-1154, CVE-2015-1155, CVE-2015-1156, CVE-2015-2330, CVE-2015-3658, CVE-2015-3659, CVE-2015-3660, CVE-2015-3727, CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-3750, CVE-2015-3751, CVE-2015-3752, CVE-2015-3753, CVE-2015-3754, CVE-2015-3755, CVE-2015-5788, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5822, CVE-2015-5823, CVE-2015-5825, CVE-2015-5826, CVE-2015-5827, CVE-2015-5828, CVE-2015-5928, CVE-2015-5929, CVE-2015-5930, CVE-2015-5931, CVE-2015-7002, CVE-2015-7012, CVE-2015-7013, CVE-2015-7014, CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7102, CVE-2015-7103, CVE-2015-7104.
Several vulnerabilities were discovered on WebKitGTK+.
CVE-2013-6663 Versions affected: WebKitGTK+ before 2.4.0. Credit to Atte Kettunen of OUSPG. Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view.
CVE-2014-1748 Versions affected: WebKitGTK+ before 2.6.0. Credit to Jordan Milne. The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.
CVE-2014-3192 Versions affected: WebKitGTK+ before 2.6.3. Credit to cloudfuzzer. Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2014-4409 Versions affected: WebKitGTK+ before 2.6.0. Credit to Yosuke Hasegawa (NetAgent Co., Led.). WebKit in Apple iOS before 8 makes it easier for remote attackers to track users during private browsing via a crafted web site that reads HTML5 application-cache data that had been stored during normal browsing.
CVE-2014-4410 Versions affected: WebKitGTK+ before 2.6.0. Credit to Eric Seidel of Google.
CVE-2014-4411 Versions affected: WebKitGTK+ before 2.6.0. Credit to Google Chrome Security Team.
CVE-2014-4412 Versions affected: WebKitGTK+ before 2.4.0. Credit to Apple.
CVE-2014-4413 Versions affected: WebKitGTK+ before 2.4.0. Credit to Apple.
CVE-2014-4414 Versions affected: WebKitGTK+ before 2.4.0. Credit to Apple.
CVE-2014-4452 Versions affected: WebKitGTK+ before 2.6.0. Credit to unknown.
CVE-2014-4459 Versions affected: WebKitGTK+ before 2.6.2. Credit to unknown.
CVE-2014-4465 Versions affected: WebKitGTK+ before 2.6.2. Credit to Rennie deGraaf of iSEC Partners. WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element.
CVE-2014-4466 Versions affected: WebKitGTK+ before 2.6.2. Credit to Apple.
CVE-2014-4468 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2014-4469 Versions affected: WebKitGTK+ before 2.6.4. Credit to Apple.
CVE-2014-4470 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2014-4471 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2014-4472 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2014-4473 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2014-4474 Versions affected: WebKitGTK+ before 2.6.2. Credit to Apple.
CVE-2014-4475 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2014-4476 Versions affected: WebKitGTK+ before 2.6.2. Credit to Apple.
CVE-2014-4477 Versions affected: WebKitGTK+ before 2.6.4. Credit to lokihardt@ASRT working with HP’s Zero Day Initiative.
CVE-2014-4479 Versions affected: WebKitGTK+ before 2.6.4. Credit to Apple.
CVE-2015-1068 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1069 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1070 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1071 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1072 Versions affected: WebKitGTK+ before 2.8.0. Credit to unknown.
CVE-2015-1073 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1074 Versions affected: WebKitGTK+ before 2.6.4. Credit to Apple.
CVE-2015-1075 Versions affected: WebKitGTK+ before 2.8.0. Credit to Google Chrome Security Team.
CVE-2015-1076 Versions affected: WebKitGTK+ before 2.8.0. Credit to unknown.
CVE-2015-1077 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1080 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2015-1081 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1082 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1083 Versions affected: WebKitGTK+ before 2.6.4. Credit to Apple.
CVE-2015-1084 Versions affected: WebKitGTK+ before 2.6.1. Credit to Apple. The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
CVE-2015-1119 Versions affected: WebKitGTK+ before 2.8.0. Credit to Renata Hodovan of University of Szeged / Samsung Electronics.
CVE-2015-1120 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1121 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1122 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-1124 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-1126 Versions affected: WebKitGTK+ before 2.8.0. Credit to Jouko Pynnonen of Klikki Oy. WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.
CVE-2015-1127 Versions affected: WebKitGTK+ before 2.8.0. Credit to Tyler C (2.6.5). The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history into an index, which might allow local users to obtain sensitive information by reading index entries.
CVE-2015-1152 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-1153 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple (2.6.5).
CVE-2015-1154 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple (2.6.5).
CVE-2015-1155 Versions affected: WebKitGTK+ before 2.10.0. Credit to Joe Vennix of Rapid7 Inc. working with HP's Zero Day Initiative.
CVE-2015-1156 Versions affected: WebKitGTK+ before 2.8.0. Credit to Zachary Durber of Moodle. The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.
CVE-2015-2330 Versions affected: WebKitGTK+ before 2.6.6. Credit to Ross Lagerwall. Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
CVE-2015-3658 Versions affected: WebKitGTK+ before 2.8.1. Credit to Brad Hill of Facebook. The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.
CVE-2015-3659 Versions affected: WebKitGTK+ before 2.8.3. Credit to Peter Rutenbar working with HP's Zero Day Initiative.
CVE-2015-3660 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-3727 Versions affected: WebKitGTK+ before 2.8.1. Credit to Peter Rutenbar working with HP's Zero Day Initiative.
CVE-2015-3730 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-3731 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3732 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3733 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3734 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3735 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3736 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3737 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3738 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-3739 Versions affected: WebKitGTK+ before 2.8.1. Credit to Apple.
CVE-2015-3740 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-3741 Versions affected: WebKitGTK+ before 2.8.1. Credit to Apple.
CVE-2015-3742 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-3743 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3744 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-3745 Versions affected: WebKitGTK+ before 2.8.1. Credit to Apple.
CVE-2015-3746 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-3747 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-3748 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3749 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-3750 Versions affected: WebKitGTK+ before 2.10.0. Credit to Muneaki Nishimura (nishimunea). WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client- server data stream.
CVE-2015-3751 Versions affected: WebKitGTK+ before 2.10.0. Credit to Muneaki Nishimura (nishimunea). WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element.
CVE-2015-3752 Versions affected: WebKitGTK+ before 2.8.4. Credit to Muneaki Nishimura (nishimunea). The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross- origin request or (2) a private-browsing request.
CVE-2015-3753 Versions affected: WebKitGTK+ before 2.8.3. Credit to Antonio Sanso and Damien Antipa of Adobe. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
CVE-2015-3754 Versions affected: WebKitGTK+ before 2.10.0. Credit to Dongsung Kim (@kid1ng). The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.
CVE-2015-3755 Versions affected: WebKitGTK+ before 2.10.0. Credit to xisigr of Tencent's Xuanwu Lab.
CVE-2015-5788 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple. The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element.
CVE-2015-5789 Versions affected: WebKitGTK+ before 2.6.1. Credit to Apple.
CVE-2015-5790 Versions affected: WebKitGTK+ before 2.6.2. Credit to Apple.
CVE-2015-5791 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2015-5792 Versions affected: WebKitGTK+ before 2.4.0. Credit to Apple.
CVE-2015-5793 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5794 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5795 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-5797 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5798 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2015-5799 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple (2.6.5).
CVE-2015-5800 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple (2.6.5).
CVE-2015-5801 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5802 Versions affected: WebKitGTK+ before 2.6.0. Credit to Apple.
CVE-2015-5803 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5804 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5805 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown.
CVE-2015-5806 Versions affected: WebKitGTK+ before 2.8.3. Credit to Apple.
CVE-2015-5807 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5809 Versions affected: WebKitGTK+ before 2.8.4. Credit to Apple.
CVE-2015-5810 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5811 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5812 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5813 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5814 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5815 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5816 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5817 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5818 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5819 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5822 Versions affected: WebKitGTK+ before 2.8.1. Credit to Mark S. Miller of Google.
CVE-2015-5823 Versions affected: WebKitGTK+ before 2.8.0. Credit to Apple.
CVE-2015-5825 Versions affected: WebKitGTK+ before 2.10.0. Credit to Yossi Oren et al. of Columbia University's Network Security Lab.
CVE-2015-5826 Versions affected: WebKitGTK+ before 2.6.5. Credit to filedescriptior, Chris Evans.
CVE-2015-5827 Versions affected: WebKitGTK+ before 2.10.0. Credit to Gildas. WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.
CVE-2015-5828 Versions affected: WebKitGTK+ before 2.10.0. Credit to Lorenzo Fontana. The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
CVE-2015-5928 Versions affected: WebKitGTK+ before 2.8.4. Credit to Apple.
CVE-2015-5929 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5930 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-5931 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown.
CVE-2015-7002 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-7012 Versions affected: WebKitGTK+ before 2.8.4. Credit to Apple.
CVE-2015-7013 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-7014 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown.
CVE-2015-7048 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-7095 Versions affected: WebKitGTK+ before 2.10.2. Credit to Apple.
CVE-2015-7097 Versions affected: WebKitGTK+ before 2.10.3. Credit to Apple.
CVE-2015-7099 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-7100 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-7102 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-7103 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
CVE-2015-7104 Versions affected: WebKitGTK+ before 2.10.0. Credit to Apple.
We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases.
Further information about WebKitGTK+ Security Advisories can be found at: http://webkitgtk.org/security.html
The WebKitGTK+ team, December 28, 2015
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2015-01-27-2 iOS 8.1.3
iOS 8.1.3 is now available and addresses the following:
AppleFileConduit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A maliciously crafted afc command may allow access to protected parts of the filesystem Description: A vulnerability existed in the symbolic linking mechanism of afc. This issue was addressed by adding additional path checks. CVE-ID CVE-2014-4480 : TaiG Jailbreak Team
CoreGraphics Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in the handling of PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4481 : Felipe Andres Manzano of the Binamuse VRT, via the iSIGHT Partners GVP Program
dyld Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to execute unsigned code Description: A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed through improved validation of segment sizes. CVE-ID CVE-2014-4455 : TaiG Jailbreak Team
FontParser Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4483 : Apple
FontParser Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Processing a maliciously crafted .dfont file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the handling of .dfont files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4484 : Gaurav Baruah working with HP's Zero Day Initiative
Foundation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted XML file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the XML parser. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4485 : Apple
IOAcceleratorFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A null pointer dereference existed in IOAcceleratorFamily's handling of resource lists. This issue was addressed by removing unneeded code. CVE-ID CVE-2014-4486 : Ian Beer of Google Project Zero
IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A buffer overflow existed in IOHIDFamily. This issue was addressed through improved size validation. CVE-ID CVE-2014-4487 : TaiG Jailbreak Team
IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in IOHIDFamily's handling of resource queue metadata. This issue was addressed through improved validation of metadata. CVE-ID CVE-2014-4488 : Apple
IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A null pointer dereference existed in IOHIDFamily's handling of event queues. This issue was addressed through improved validation. CVE-ID CVE-2014-4489 : @beist
iTunes Store Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A website may be able to bypass sandbox restrictions using the iTunes Store Description: An issue existed in the handling of URLs redirected from Safari to the iTunes Store that could allow a malicious website to bypass Safari's sandbox restrictions. The issue was addressed with improved filtering of URLs opened by the iTunes Store. CVE-ID CVE-2014-8840 : lokihardt@ASRT working with HP's Zero Day Initiative
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Maliciously crafted or compromised iOS applications may be able to determine addresses in the kernel Description: An information disclosure issue existed in the handling of APIs related to kernel extensions. Responses containing an OSBundleMachOHeaders key may have included kernel addresses, which may aid in bypassing address space layout randomization protection. This issue was addressed by unsliding the addresses before returning them. CVE-ID CVE-2014-4491 : @PanguTeam, Stefan Esser
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An issue existed in the kernel shared memory subsystem that allowed an attacker to write to memory that was intended to be read-only. This issue was addressed with stricter checking of shared memory permissions. CVE-ID CVE-2014-4495 : Ian Beer of Google Project Zero
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Maliciously crafted or compromised iOS applications may be able to determine addresses in the kernel Description: The mach_port_kobject kernel interface leaked kernel addresses and heap permutation value, which may aid in bypassing address space layout randomization protection. This was addressed by disabling the mach_port_kobject interface in production configurations. CVE-ID CVE-2014-4496 : TaiG Jailbreak Team
libnetcore Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious, sandboxed app can compromise the networkd daemon Description: Multiple type confusion issues existed in networkd's handling of interprocess communication. By sending a maliciously formatted message to networkd, it may have been possible to execute arbitrary code as the networkd process. The issue is addressed through additional type checking. CVE-ID CVE-2014-4492 : Ian Beer of Google Project Zero
MobileInstallation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious enterprise-signed application may be able to take control of the local container for applications already on a device Description: A vulnerability existed in the application installation process. This was addressed by preventing enterprise applications from overriding existing applications in specific scenarios. CVE-ID CVE-2014-4493 : Hui Xue and Tao Wei of FireEye, Inc.
Springboard Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Enterprise-signed applications may be launched without prompting for trust Description: An issue existed in determining when to prompt for trust when first opening an enterprise-signed application. This issue was addressed through improved code signature validation. CVE-ID CVE-2014-4494 : Song Jin, Hui Xue, and Tao Wei of FireEye, Inc.
WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: A UI spoofing issue existed in the handling of scrollbar boundaries. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4467 : Jordan Milne
WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Style sheets are loaded cross-origin which may allow for data exfiltration Description: An SVG loaded in an img element could load a CSS file cross-origin. This issue was addressed through enhanced blocking of external CSS references in SVGs. CVE-ID CVE-2014-4465 : Rennie deGraaf of iSEC Partners
WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About.
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
iQIcBAEBAgAGBQJUx8umAAoJEBcWfLTuOo7tTskQAI5o4uXj16m90mQhSqUYG35F pCbUBiLJj4IWcgLsNDKgnhcmX6YOA+q7LnyCuU91K4DLybFZr5/OrxDU4/qCsKQb 8o6uRHdtfq6zrOrUgv+hKXP36Rf5v/zl/P9JViuJoKZXMQow6DYoTpCaUAUwp23z mrF3EwzZyxfT2ICWwPS7r8A9annIprGBZLJz1Yr7Ek90WILTg9RbgnI60IBfpLzn Bi4ej9FqV2HAy4S9Fad6jyB9E0rAsl6PRMPGKVvOa2o1/mLqiFGR06qyHwJ+ynj8 tTGcnVhiZVaiur807DY1hb6uB2oLFQXxHFYe3T17l3igM/iminMpWfcq/PmnIIwR IASrhc24qgUywOGK6FfVKdoh5KNgb3xK4X7U9YL9/eMwgT48a2qO6lLTfYdFfBCh wEzMAFEDpnkwOSw/s5Ry0eCY+p+DU0Kxr3Ter3zkNO0abf2yXjAtu4nHBk3I1t4P y8fM8vcWhPDTdfhIWp5Vwcs6sxCGXO1/w6Okuv4LlEDkSJ0Vm2AdhnE0TmhWW0BB w7XMGRYdUCYRbGIta1wciD8yR1xeAWGIOL9+tYROfK4jgPgFGNjtkhqMWNxLZwnR IEHZ2hYBhf3bWCtEDP5nZBV7jdUUdMxDzDX9AuPp67SXld2By+iMe8AYgu6EVhfY CfDJ+b9mxdd8GswiT3OO =j9pr -----END PGP SIGNATURE----- . CVE-ID CVE-2014-4460
Spotlight Available for: OS X Yosemite v10.10 Impact: Unnecessary information is included as part of the initial connection between Spotlight or Safari and the Spotlight Suggestions servers Description: The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user's approximate location before a user entered a query. CVE-ID CVE-2014-4453 : Ashkan Soltani
System Profiler About This Mac Available for: OS X Yosemite v10.10 Impact: Unnecessary information is included as part of a connection to Apple to determine the system model Description: The request made by About This Mac to determine the model of the system and direct users to the correct help resources included unnecessary cookies. CVE-ID CVE-2014-4459
OS X Yosemite 10.10.1 may be obtained from the Mac App Store
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201411-0271",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.10.1"
},
{
"model": "safari",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "8.0"
},
{
"model": "safari",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "6.2.1"
},
{
"model": "safari",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "8.0.1"
},
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "safari",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "6.0"
},
{
"model": "itunes",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.2"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "8.1.3"
},
{
"model": "safari",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "7.0"
},
{
"model": "safari",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "7.1.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.10"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(ipad 2 or later )"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "12.2"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(os x yosemite v10.10.1)"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "8.0.2"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(os x mountain lion v10.8.5)"
},
{
"model": "itunes",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(windows 8)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8.x (os x yosemite v10.10.1)"
},
{
"model": "itunes",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(windows 7)"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "8.1.3"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(iphone 4s or later )"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.x (os x mountain lion v10.8.5)"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(ipod touch first 5 after generation )"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8.x (os x mountain lion v10.8.5)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(os x mavericks v10.9.5)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.x (os x mavericks v10.9.5)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8.x (os x mavericks v10.9.5)"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "6.2.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "tv",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "(apple tv first 3 after generation )"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.x (os x yosemite v10.10.1)"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.5.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.3.4"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.5.5"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.6.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.5.8"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.5.7"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.3.5"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.6.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.6.0"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.6.7"
},
{
"model": "open source project webkit",
"scope": "eq",
"trust": 0.3,
"vendor": "webkit",
"version": "0"
},
{
"model": "directory pro",
"scope": "eq",
"trust": 0.3,
"vendor": "cosmicperl",
"version": "10.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.11"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.10"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.5.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1.8"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.0.2.20"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.6"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.5"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.4"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
}
],
"sources": [
{
"db": "BID",
"id": "71144"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-312"
},
{
"db": "NVD",
"id": "CVE-2014-4459"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:apple_tv",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:itunes",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:safari",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "PACKETSTORM",
"id": "132529"
},
{
"db": "PACKETSTORM",
"id": "130130"
},
{
"db": "PACKETSTORM",
"id": "130129"
},
{
"db": "PACKETSTORM",
"id": "129159"
},
{
"db": "PACKETSTORM",
"id": "129391"
}
],
"trust": 0.5
},
"cve": "CVE-2014-4459",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2014-4459",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-72399",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-4459",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-4459",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201411-312",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-72399",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72399"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-312"
},
{
"db": "NVD",
"id": "CVE-2014-4459"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attackers to execute arbitrary code via crafted page objects in an HTML document. Apple OS X Used in etc. Webkit Use freed memory (Use-after-free) May allow arbitrary code execution vulnerabilities. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. WebKit is prone to an unspecified memory-corruption vulnerability. \nAn attacker may exploit this issue by enticing victims into viewing a malicious webpage. \nSuccessful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. ------------------------------------------------------------------------\nWebKitGTK+ Security Advisory WSA-2015-0002\n------------------------------------------------------------------------\n\nDate reported : December 28, 2015\nAdvisory ID : WSA-2015-0002\nAdvisory URL : http://webkitgtk.org/security/WSA-2015-0002.html\nCVE identifiers : CVE-2013-6663, CVE-2014-1748, CVE-2014-3192,\n CVE-2014-4409, CVE-2014-4410, CVE-2014-4411,\n CVE-2014-4412, CVE-2014-4413, CVE-2014-4414,\n CVE-2014-4452, CVE-2014-4459, CVE-2014-4465,\n CVE-2014-4466, CVE-2014-4468, CVE-2014-4469,\n CVE-2014-4470, CVE-2014-4471, CVE-2014-4472,\n CVE-2014-4473, CVE-2014-4474, CVE-2014-4475,\n CVE-2014-4476, CVE-2014-4477, CVE-2014-4479,\n CVE-2015-1068, CVE-2015-1069, CVE-2015-1070,\n CVE-2015-1071, CVE-2015-1072, CVE-2015-1073,\n CVE-2015-1074, CVE-2015-1075, CVE-2015-1076,\n CVE-2015-1077, CVE-2015-1080, CVE-2015-1081,\n CVE-2015-1082, CVE-2015-1083, CVE-2015-1084,\n CVE-2015-1119, CVE-2015-1120, CVE-2015-1121,\n CVE-2015-1122, CVE-2015-1124, CVE-2015-1126,\n CVE-2015-1127, CVE-2015-1152, CVE-2015-1153,\n CVE-2015-1154, CVE-2015-1155, CVE-2015-1156,\n CVE-2015-2330, CVE-2015-3658, CVE-2015-3659,\n CVE-2015-3660, CVE-2015-3727, CVE-2015-3730,\n CVE-2015-3731, CVE-2015-3732, CVE-2015-3733,\n CVE-2015-3734, CVE-2015-3735, CVE-2015-3736,\n CVE-2015-3737, CVE-2015-3738, CVE-2015-3739,\n CVE-2015-3740, CVE-2015-3741, CVE-2015-3742,\n CVE-2015-3743, CVE-2015-3744, CVE-2015-3745,\n CVE-2015-3746, CVE-2015-3747, CVE-2015-3748,\n CVE-2015-3749, CVE-2015-3750, CVE-2015-3751,\n CVE-2015-3752, CVE-2015-3753, CVE-2015-3754,\n CVE-2015-3755, CVE-2015-5788, CVE-2015-5789,\n CVE-2015-5790, CVE-2015-5791, CVE-2015-5792,\n CVE-2015-5793, CVE-2015-5794, CVE-2015-5795,\n CVE-2015-5797, CVE-2015-5798, CVE-2015-5799,\n CVE-2015-5800, CVE-2015-5801, CVE-2015-5802,\n CVE-2015-5803, CVE-2015-5804, CVE-2015-5805,\n CVE-2015-5806, CVE-2015-5807, CVE-2015-5809,\n CVE-2015-5810, CVE-2015-5811, CVE-2015-5812,\n CVE-2015-5813, CVE-2015-5814, CVE-2015-5815,\n CVE-2015-5816, CVE-2015-5817, CVE-2015-5818,\n CVE-2015-5819, CVE-2015-5822, CVE-2015-5823,\n CVE-2015-5825, CVE-2015-5826, CVE-2015-5827,\n CVE-2015-5828, CVE-2015-5928, CVE-2015-5929,\n CVE-2015-5930, CVE-2015-5931, CVE-2015-7002,\n CVE-2015-7012, CVE-2015-7013, CVE-2015-7014,\n CVE-2015-7048, CVE-2015-7095, CVE-2015-7097,\n CVE-2015-7099, CVE-2015-7100, CVE-2015-7102,\n CVE-2015-7103, CVE-2015-7104. \n\nSeveral vulnerabilities were discovered on WebKitGTK+. \n\nCVE-2013-6663\n Versions affected: WebKitGTK+ before 2.4.0. \n Credit to Atte Kettunen of OUSPG. \n Use-after-free vulnerability in the SVGImage::setContainerSize\n function in core/svg/graphics/SVGImage.cpp in the SVG implementation\n in Blink, as used in Google Chrome before 33.0.1750.146, allows\n remote attackers to cause a denial of service or possibly have\n unspecified other impact via vectors related to the resizing of a\n view. \n\nCVE-2014-1748\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Jordan Milne. \n The ScrollView::paint function in platform/scroll/ScrollView.cpp in\n Blink, as used in Google Chrome before 35.0.1916.114, allows remote\n attackers to spoof the UI by extending scrollbar painting into the\n parent frame. \n\nCVE-2014-3192\n Versions affected: WebKitGTK+ before 2.6.3. \n Credit to cloudfuzzer. \n Use-after-free vulnerability in the\n ProcessingInstruction::setXSLStyleSheet function in\n core/dom/ProcessingInstruction.cpp in the DOM implementation in\n Blink, as used in Google Chrome before 38.0.2125.101, allows remote\n attackers to cause a denial of service or possibly have unspecified\n other impact via unknown vectors. \n\nCVE-2014-4409\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Yosuke Hasegawa (NetAgent Co., Led.). \n WebKit in Apple iOS before 8 makes it easier for remote attackers to\n track users during private browsing via a crafted web site that\n reads HTML5 application-cache data that had been stored during\n normal browsing. \n\nCVE-2014-4410\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Eric Seidel of Google. \n\nCVE-2014-4411\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Google Chrome Security Team. \n\nCVE-2014-4412\n Versions affected: WebKitGTK+ before 2.4.0. \n Credit to Apple. \n\nCVE-2014-4413\n Versions affected: WebKitGTK+ before 2.4.0. \n Credit to Apple. \n\nCVE-2014-4414\n Versions affected: WebKitGTK+ before 2.4.0. \n Credit to Apple. \n\nCVE-2014-4452\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to unknown. \n\nCVE-2014-4459\n Versions affected: WebKitGTK+ before 2.6.2. \n Credit to unknown. \n\nCVE-2014-4465\n Versions affected: WebKitGTK+ before 2.6.2. \n Credit to Rennie deGraaf of iSEC Partners. \n WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x\n before 8.0.1 allows remote attackers to bypass the Same Origin\n Policy via crafted Cascading Style Sheets (CSS) token sequences\n within an SVG file in the SRC attribute of an IMG element. \n\nCVE-2014-4466\n Versions affected: WebKitGTK+ before 2.6.2. \n Credit to Apple. \n\nCVE-2014-4468\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2014-4469\n Versions affected: WebKitGTK+ before 2.6.4. \n Credit to Apple. \n\nCVE-2014-4470\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2014-4471\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2014-4472\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2014-4473\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2014-4474\n Versions affected: WebKitGTK+ before 2.6.2. \n Credit to Apple. \n\nCVE-2014-4475\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2014-4476\n Versions affected: WebKitGTK+ before 2.6.2. \n Credit to Apple. \n\nCVE-2014-4477\n Versions affected: WebKitGTK+ before 2.6.4. \n Credit to lokihardt@ASRT working with HP\u2019s Zero Day Initiative. \n\nCVE-2014-4479\n Versions affected: WebKitGTK+ before 2.6.4. \n Credit to Apple. \n\nCVE-2015-1068\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1069\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1070\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1071\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1072\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to unknown. \n\nCVE-2015-1073\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1074\n Versions affected: WebKitGTK+ before 2.6.4. \n Credit to Apple. \n\nCVE-2015-1075\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Google Chrome Security Team. \n\nCVE-2015-1076\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to unknown. \n\nCVE-2015-1077\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1080\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2015-1081\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1082\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1083\n Versions affected: WebKitGTK+ before 2.6.4. \n Credit to Apple. \n\nCVE-2015-1084\n Versions affected: WebKitGTK+ before 2.6.1. \n Credit to Apple. \n The user interface in WebKit, as used in Apple Safari before 6.2.4,\n 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs\n consistently, which makes it easier for remote attackers to conduct\n phishing attacks via a crafted URL. \n\nCVE-2015-1119\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Renata Hodovan of University of Szeged / Samsung\n Electronics. \n\nCVE-2015-1120\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1121\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1122\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-1124\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-1126\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Jouko Pynnonen of Klikki Oy. \n WebKit, as used in Apple iOS before 8.3 and Apple Safari before\n 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly\n handle the userinfo field in FTP URLs, which allows remote attackers\n to trigger incorrect resource access via unspecified vectors. \n\nCVE-2015-1127\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Tyler C (2.6.5). \n The private-browsing implementation in WebKit in Apple Safari before\n 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing\n history into an index, which might allow local users to obtain\n sensitive information by reading index entries. \n\nCVE-2015-1152\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-1153\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple (2.6.5). \n\nCVE-2015-1154\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple (2.6.5). \n\nCVE-2015-1155\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Joe Vennix of Rapid7 Inc. working with HP\u0027s Zero Day\n Initiative. \n\nCVE-2015-1156\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Zachary Durber of Moodle. \n The page-loading implementation in WebKit, as used in Apple Safari\n before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not\n properly handle the rel attribute in an A element, which allows\n remote attackers to bypass the Same Origin Policy for a link\u0027s\n target, and spoof the user interface, via a crafted web site. \n\nCVE-2015-2330\n Versions affected: WebKitGTK+ before 2.6.6. \n Credit to Ross Lagerwall. \n Late TLS certificate verification in WebKitGTK+ prior to 2.6.6\n allows remote attackers to view a secure HTTP request, including,\n for example, secure cookies. \n\nCVE-2015-3658\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Brad Hill of Facebook. \n The Page Loading functionality in WebKit in Apple Safari before\n 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS\n before 8.4 and other products, does not properly consider redirects\n during decisions about sending an Origin header, which makes it\n easier for remote attackers to bypass CSRF protection mechanisms via\n a crafted web site. \n\nCVE-2015-3659\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Peter Rutenbar working with HP\u0027s Zero Day Initiative. \n\nCVE-2015-3660\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-3727\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Peter Rutenbar working with HP\u0027s Zero Day Initiative. \n\nCVE-2015-3730\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-3731\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3732\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3733\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3734\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3735\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3736\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3737\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3738\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-3739\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Apple. \n\nCVE-2015-3740\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-3741\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Apple. \n\nCVE-2015-3742\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-3743\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3744\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-3745\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Apple. \n\nCVE-2015-3746\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-3747\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-3748\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3749\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-3750\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Muneaki Nishimura (nishimunea). \n WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x\n before 8.0.8, as used in iOS before 8.4.1 and other products, does\n not enforce the HTTP Strict Transport Security (HSTS) protection\n mechanism for Content Security Policy (CSP) report requests, which\n allows man-in-the-middle attackers to obtain sensitive information\n by sniffing the network or spoof a report by modifying the client-\n server data stream. \n\nCVE-2015-3751\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Muneaki Nishimura (nishimunea). \n WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x\n before 8.0.8, as used in iOS before 8.4.1 and other products, allows\n remote attackers to bypass a Content Security Policy protection\n mechanism by using a video control in conjunction with an IMG\n element within an OBJECT element. \n\nCVE-2015-3752\n Versions affected: WebKitGTK+ before 2.8.4. \n Credit to Muneaki Nishimura (nishimunea). \n The Content Security Policy implementation in WebKit in Apple Safari\n before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS\n before 8.4.1 and other products, does not properly restrict cookie\n transmission for report requests, which allows remote attackers to\n obtain sensitive information via vectors involving (1) a cross-\n origin request or (2) a private-browsing request. \n\nCVE-2015-3753\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Antonio Sanso and Damien Antipa of Adobe. \n WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x\n before 8.0.8, as used in iOS before 8.4.1 and other products, does\n not properly perform taint checking for CANVAS elements, which\n allows remote attackers to bypass the Same Origin Policy and obtain\n sensitive image data by leveraging a redirect to a data:image\n resource. \n\nCVE-2015-3754\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Dongsung Kim (@kid1ng). \n The private-browsing implementation in WebKit in Apple Safari before\n 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent\n caching of HTTP authentication credentials, which makes it easier\n for remote attackers to track users via a crafted web site. \n\nCVE-2015-3755\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to xisigr of Tencent\u0027s Xuanwu Lab. \n\nCVE-2015-5788\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n The WebKit Canvas implementation in Apple iOS before 9 allows remote\n attackers to bypass the Same Origin Policy and obtain sensitive\n image information via vectors involving a CANVAS element. \n\nCVE-2015-5789\n Versions affected: WebKitGTK+ before 2.6.1. \n Credit to Apple. \n\nCVE-2015-5790\n Versions affected: WebKitGTK+ before 2.6.2. \n Credit to Apple. \n\nCVE-2015-5791\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2015-5792\n Versions affected: WebKitGTK+ before 2.4.0. \n Credit to Apple. \n\nCVE-2015-5793\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5794\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5795\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-5797\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5798\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2015-5799\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple (2.6.5). \n\nCVE-2015-5800\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple (2.6.5). \n\nCVE-2015-5801\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5802\n Versions affected: WebKitGTK+ before 2.6.0. \n Credit to Apple. \n\nCVE-2015-5803\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5804\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5805\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to unknown. \n\nCVE-2015-5806\n Versions affected: WebKitGTK+ before 2.8.3. \n Credit to Apple. \n\nCVE-2015-5807\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5809\n Versions affected: WebKitGTK+ before 2.8.4. \n Credit to Apple. \n\nCVE-2015-5810\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5811\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5812\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5813\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5814\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5815\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5816\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5817\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5818\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5819\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5822\n Versions affected: WebKitGTK+ before 2.8.1. \n Credit to Mark S. Miller of Google. \n\nCVE-2015-5823\n Versions affected: WebKitGTK+ before 2.8.0. \n Credit to Apple. \n\nCVE-2015-5825\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Yossi Oren et al. of Columbia University\u0027s Network\n Security Lab. \n\nCVE-2015-5826\n Versions affected: WebKitGTK+ before 2.6.5. \n Credit to filedescriptior, Chris Evans. \n\nCVE-2015-5827\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Gildas. \n WebKit in Apple iOS before 9 allows remote attackers to bypass the\n Same Origin Policy and obtain an object reference via vectors\n involving a (1) custom event, (2) message event, or (3) pop state\n event. \n\nCVE-2015-5828\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Lorenzo Fontana. \n The API in the WebKit Plug-ins component in Apple Safari before 9\n does not provide notification of an HTTP Redirection (aka 3xx)\n status code to a plugin, which allows remote attackers to bypass\n intended request restrictions via a crafted web site. \n\nCVE-2015-5928\n Versions affected: WebKitGTK+ before 2.8.4. \n Credit to Apple. \n\nCVE-2015-5929\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5930\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-5931\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to unknown. \n\nCVE-2015-7002\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-7012\n Versions affected: WebKitGTK+ before 2.8.4. \n Credit to Apple. \n\nCVE-2015-7013\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-7014\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to unknown. \n\nCVE-2015-7048\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-7095\n Versions affected: WebKitGTK+ before 2.10.2. \n Credit to Apple. \n\nCVE-2015-7097\n Versions affected: WebKitGTK+ before 2.10.3. \n Credit to Apple. \n\nCVE-2015-7099\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-7100\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-7102\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-7103\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\nCVE-2015-7104\n Versions affected: WebKitGTK+ before 2.10.0. \n Credit to Apple. \n\n\nWe recommend updating to the last stable version of WebKitGTK+. It is\nthe best way of ensuring that you are running a safe version of\nWebKitGTK+. Please check our website for information about the last\nstable releases. \n\nFurther information about WebKitGTK+ Security Advisories can be found\nat: http://webkitgtk.org/security.html\n\nThe WebKitGTK+ team,\nDecember 28, 2015\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2015-01-27-2 iOS 8.1.3\n\niOS 8.1.3 is now available and addresses the following:\n\nAppleFileConduit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A maliciously crafted afc command may allow access to\nprotected parts of the filesystem\nDescription: A vulnerability existed in the symbolic linking\nmechanism of afc. This issue was addressed by adding additional path\nchecks. \nCVE-ID\nCVE-2014-4480 : TaiG Jailbreak Team\n\nCoreGraphics\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Opening a maliciously crafted PDF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An integer overflow existed in the handling of PDF\nfiles. This issue was addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4481 : Felipe Andres Manzano of the Binamuse VRT, via the\niSIGHT Partners GVP Program\n\ndyld\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A local user may be able to execute unsigned code\nDescription: A state management issue existed in the handling of\nMach-O executable files with overlapping segments. This issue was\naddressed through improved validation of segment sizes. \nCVE-ID\nCVE-2014-4455 : TaiG Jailbreak Team\n\nFontParser\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Opening a maliciously crafted PDF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the handling of font\nfiles. This issue was addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4483 : Apple\n\nFontParser\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Processing a maliciously crafted .dfont file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A memory corruption issue existed in the handling of\n.dfont files. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2014-4484 : Gaurav Baruah working with HP\u0027s Zero Day Initiative\n\nFoundation\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Viewing a maliciously crafted XML file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the XML parser. This issue\nwas addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4485 : Apple\n\nIOAcceleratorFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A null pointer dereference existed in\nIOAcceleratorFamily\u0027s handling of resource lists. This issue was\naddressed by removing unneeded code. \nCVE-ID\nCVE-2014-4486 : Ian Beer of Google Project Zero\n\nIOHIDFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A buffer overflow existed in IOHIDFamily. This issue\nwas addressed through improved size validation. \nCVE-ID\nCVE-2014-4487 : TaiG Jailbreak Team\n\nIOHIDFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A validation issue existed in IOHIDFamily\u0027s handling of\nresource queue metadata. This issue was addressed through improved\nvalidation of metadata. \nCVE-ID\nCVE-2014-4488 : Apple\n\nIOHIDFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A null pointer dereference existed in IOHIDFamily\u0027s\nhandling of event queues. This issue was addressed through improved\nvalidation. \nCVE-ID\nCVE-2014-4489 : @beist\n\niTunes Store\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A website may be able to bypass sandbox restrictions using\nthe iTunes Store\nDescription: An issue existed in the handling of URLs redirected\nfrom Safari to the iTunes Store that could allow a malicious website\nto bypass Safari\u0027s sandbox restrictions. The issue was addressed with\nimproved filtering of URLs opened by the iTunes Store. \nCVE-ID\nCVE-2014-8840 : lokihardt@ASRT working with HP\u0027s Zero Day Initiative\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Maliciously crafted or compromised iOS applications may be\nable to determine addresses in the kernel\nDescription: An information disclosure issue existed in the handling\nof APIs related to kernel extensions. Responses containing an\nOSBundleMachOHeaders key may have included kernel addresses, which\nmay aid in bypassing address space layout randomization protection. \nThis issue was addressed by unsliding the addresses before returning\nthem. \nCVE-ID\nCVE-2014-4491 : @PanguTeam, Stefan Esser\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: An issue existed in the kernel shared memory subsystem\nthat allowed an attacker to write to memory that was intended to be\nread-only. This issue was addressed with stricter checking of shared\nmemory permissions. \nCVE-ID\nCVE-2014-4495 : Ian Beer of Google Project Zero\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Maliciously crafted or compromised iOS applications may be\nable to determine addresses in the kernel\nDescription: The mach_port_kobject kernel interface leaked kernel\naddresses and heap permutation value, which may aid in bypassing\naddress space layout randomization protection. This was addressed by\ndisabling the mach_port_kobject interface in production\nconfigurations. \nCVE-ID\nCVE-2014-4496 : TaiG Jailbreak Team\n\nlibnetcore\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious, sandboxed app can compromise the networkd\ndaemon\nDescription: Multiple type confusion issues existed in networkd\u0027s\nhandling of interprocess communication. By sending a maliciously\nformatted message to networkd, it may have been possible to execute\narbitrary code as the networkd process. The issue is addressed\nthrough additional type checking. \nCVE-ID\nCVE-2014-4492 : Ian Beer of Google Project Zero\n\nMobileInstallation\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious enterprise-signed application may be able to\ntake control of the local container for applications already on a\ndevice\nDescription: A vulnerability existed in the application installation\nprocess. This was addressed by preventing enterprise applications\nfrom overriding existing applications in specific scenarios. \nCVE-ID\nCVE-2014-4493 : Hui Xue and Tao Wei of FireEye, Inc. \n\nSpringboard\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Enterprise-signed applications may be launched without\nprompting for trust\nDescription: An issue existed in determining when to prompt for\ntrust when first opening an enterprise-signed application. This issue\nwas addressed through improved code signature validation. \nCVE-ID\nCVE-2014-4494 : Song Jin, Hui Xue, and Tao Wei of FireEye, Inc. \n\nWebKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Visiting a website that frames malicious content may lead to\nUI spoofing\nDescription: A UI spoofing issue existed in the handling of\nscrollbar boundaries. This issue was addressed through improved\nbounds checking. \nCVE-ID\nCVE-2014-4467 : Jordan Milne\n\nWebKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Style sheets are loaded cross-origin which may allow for\ndata exfiltration\nDescription: An SVG loaded in an img element could load a CSS file\ncross-origin. This issue was addressed through enhanced blocking of\nexternal CSS references in SVGs. \nCVE-ID\nCVE-2014-4465 : Rennie deGraaf of iSEC Partners\n\nWebKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Visiting a maliciously crafted website may lead to an\nunexpected application termination or arbitrary code execution\nDescription: Multiple memory corruption issues existed in WebKit. \nThese issues were addressed through improved memory handling. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.22 (Darwin)\n\niQIcBAEBAgAGBQJUx8umAAoJEBcWfLTuOo7tTskQAI5o4uXj16m90mQhSqUYG35F\npCbUBiLJj4IWcgLsNDKgnhcmX6YOA+q7LnyCuU91K4DLybFZr5/OrxDU4/qCsKQb\n8o6uRHdtfq6zrOrUgv+hKXP36Rf5v/zl/P9JViuJoKZXMQow6DYoTpCaUAUwp23z\nmrF3EwzZyxfT2ICWwPS7r8A9annIprGBZLJz1Yr7Ek90WILTg9RbgnI60IBfpLzn\nBi4ej9FqV2HAy4S9Fad6jyB9E0rAsl6PRMPGKVvOa2o1/mLqiFGR06qyHwJ+ynj8\ntTGcnVhiZVaiur807DY1hb6uB2oLFQXxHFYe3T17l3igM/iminMpWfcq/PmnIIwR\nIASrhc24qgUywOGK6FfVKdoh5KNgb3xK4X7U9YL9/eMwgT48a2qO6lLTfYdFfBCh\nwEzMAFEDpnkwOSw/s5Ry0eCY+p+DU0Kxr3Ter3zkNO0abf2yXjAtu4nHBk3I1t4P\ny8fM8vcWhPDTdfhIWp5Vwcs6sxCGXO1/w6Okuv4LlEDkSJ0Vm2AdhnE0TmhWW0BB\nw7XMGRYdUCYRbGIta1wciD8yR1xeAWGIOL9+tYROfK4jgPgFGNjtkhqMWNxLZwnR\nIEHZ2hYBhf3bWCtEDP5nZBV7jdUUdMxDzDX9AuPp67SXld2By+iMe8AYgu6EVhfY\nCfDJ+b9mxdd8GswiT3OO\n=j9pr\n-----END PGP SIGNATURE-----\n. \nCVE-ID\nCVE-2014-4460\n\nSpotlight\nAvailable for: OS X Yosemite v10.10\nImpact: Unnecessary information is included as part of the initial\nconnection between Spotlight or Safari and the Spotlight Suggestions\nservers\nDescription: The initial connection made by Spotlight or Safari to\nthe Spotlight Suggestions servers included a user\u0027s approximate\nlocation before a user entered a query. \nCVE-ID\nCVE-2014-4453 : Ashkan Soltani\n\nSystem Profiler About This Mac\nAvailable for: OS X Yosemite v10.10\nImpact: Unnecessary information is included as part of a connection\nto Apple to determine the system model\nDescription: The request made by About This Mac to determine the\nmodel of the system and direct users to the correct help resources\nincluded unnecessary cookies. \nCVE-ID\nCVE-2014-4459\n\n\nOS X Yosemite 10.10.1 may be obtained from the Mac App Store",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-4459"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"db": "BID",
"id": "71144"
},
{
"db": "VULHUB",
"id": "VHN-72399"
},
{
"db": "PACKETSTORM",
"id": "132529"
},
{
"db": "PACKETSTORM",
"id": "135081"
},
{
"db": "PACKETSTORM",
"id": "130130"
},
{
"db": "PACKETSTORM",
"id": "130129"
},
{
"db": "PACKETSTORM",
"id": "129159"
},
{
"db": "PACKETSTORM",
"id": "129391"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-4459",
"trust": 3.4
},
{
"db": "BID",
"id": "71144",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "62503",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1031230",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU92305751",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU96447236",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005515",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201411-312",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-72399",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "132529",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "135081",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "130130",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "130129",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "129159",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "129391",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72399"
},
{
"db": "BID",
"id": "71144"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"db": "PACKETSTORM",
"id": "132529"
},
{
"db": "PACKETSTORM",
"id": "135081"
},
{
"db": "PACKETSTORM",
"id": "130130"
},
{
"db": "PACKETSTORM",
"id": "130129"
},
{
"db": "PACKETSTORM",
"id": "129159"
},
{
"db": "PACKETSTORM",
"id": "129391"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-312"
},
{
"db": "NVD",
"id": "CVE-2014-4459"
}
]
},
"id": "VAR-201411-0271",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-72399"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T21:02:35.493000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APPLE-SA-2015-06-30-6 iTunes 12.2",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html"
},
{
"title": "APPLE-SA-2014-11-17-2",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2014/Nov/msg00001.html"
},
{
"title": "APPLE-SA-2014-12-2-1",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html"
},
{
"title": "APPLE-SA-2015-01-27-2",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html"
},
{
"title": "APPLE-SA-2015-01-27-1",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html"
},
{
"title": "APPLE-SA-2014-12-11-1",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2014/Dec/msg00002.html"
},
{
"title": "HT204245",
"trust": 0.8,
"url": "http://support.apple.com/en-us/HT204245"
},
{
"title": "HT6596",
"trust": 0.8,
"url": "http://support.apple.com/en-eu/HT6596"
},
{
"title": "HT204246",
"trust": 0.8,
"url": "http://support.apple.com/en-us/HT204246"
},
{
"title": "HT6597",
"trust": 0.8,
"url": "http://support.apple.com/en-us/HT6597"
},
{
"title": "HT204949",
"trust": 0.8,
"url": "http://support.apple.com/en-us/HT204949"
},
{
"title": "HT6591",
"trust": 0.8,
"url": "https://support.apple.com/en-eu/HT6591"
},
{
"title": "HT6591",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT6591"
},
{
"title": "HT204245",
"trust": 0.8,
"url": "http://support.apple.com/ja-jp/HT204245"
},
{
"title": "HT6596",
"trust": 0.8,
"url": "http://support.apple.com/ja-jp/HT6596"
},
{
"title": "HT204246",
"trust": 0.8,
"url": "http://support.apple.com/ja-jp/HT204246"
},
{
"title": "HT6597",
"trust": 0.8,
"url": "http://support.apple.com/ja-jp/HT6597"
},
{
"title": "HT204949",
"trust": 0.8,
"url": "http://support.apple.com/ja-jp/HT204949"
},
{
"title": "OSXUpd10.10.1",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52402"
},
{
"title": "iPhone7,2_8.1.1_12B436_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52401"
},
{
"title": "AppleTV3,1_7.0.2_12B435_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52403"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-312"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"db": "NVD",
"id": "CVE-2014-4459"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/71144"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2014/nov/msg00001.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2014/dec/msg00000.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2015/jan/msg00000.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2015/jan/msg00001.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2015/jun/msg00006.html"
},
{
"trust": 1.7,
"url": "http://support.apple.com/ht204245"
},
{
"trust": 1.7,
"url": "http://support.apple.com/ht204246"
},
{
"trust": 1.7,
"url": "http://support.apple.com/kb/ht6596"
},
{
"trust": 1.7,
"url": "https://support.apple.com/en-us/ht204419"
},
{
"trust": 1.7,
"url": "https://support.apple.com/en-us/ht6591"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht204949"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id/1031230"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/62503"
},
{
"trust": 1.7,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98784"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4459"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu92305751/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu96447236/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4459"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4459"
},
{
"trust": 0.5,
"url": "http://support.apple.com/kb/ht1222"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4471"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4473"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4468"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4475"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4474"
},
{
"trust": 0.5,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4469"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4472"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4470"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4466"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4479"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4476"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-3192"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4477"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4465"
},
{
"trust": 0.3,
"url": "http://www.apple.com/macosx/"
},
{
"trust": 0.3,
"url": "http://www.webkit.org/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4452"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1069"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1070"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1071"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1068"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1748"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4485"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4484"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4483"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4491"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4487"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4481"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4488"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4489"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4455"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4480"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4492"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4486"
},
{
"trust": 0.2,
"url": "http://gpgtools.org"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1073"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1075"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1079"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1076"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1077"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1074"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1072"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1080"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-1078"
},
{
"trust": 0.1,
"url": "http://www.apple.com/itunes/download/"
},
{
"trust": 0.1,
"url": "http://webkitgtk.org/security.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-6663"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4411"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4413"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4410"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4409"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4414"
},
{
"trust": 0.1,
"url": "http://webkitgtk.org/security/wsa-2015-0002.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4412"
},
{
"trust": 0.1,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4467"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4495"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4460"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4453"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4458"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72399"
},
{
"db": "BID",
"id": "71144"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"db": "PACKETSTORM",
"id": "132529"
},
{
"db": "PACKETSTORM",
"id": "135081"
},
{
"db": "PACKETSTORM",
"id": "130130"
},
{
"db": "PACKETSTORM",
"id": "130129"
},
{
"db": "PACKETSTORM",
"id": "129159"
},
{
"db": "PACKETSTORM",
"id": "129391"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-312"
},
{
"db": "NVD",
"id": "CVE-2014-4459"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-72399"
},
{
"db": "BID",
"id": "71144"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"db": "PACKETSTORM",
"id": "132529"
},
{
"db": "PACKETSTORM",
"id": "135081"
},
{
"db": "PACKETSTORM",
"id": "130130"
},
{
"db": "PACKETSTORM",
"id": "130129"
},
{
"db": "PACKETSTORM",
"id": "129159"
},
{
"db": "PACKETSTORM",
"id": "129391"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-312"
},
{
"db": "NVD",
"id": "CVE-2014-4459"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-11-18T00:00:00",
"db": "VULHUB",
"id": "VHN-72399"
},
{
"date": "2014-11-17T00:00:00",
"db": "BID",
"id": "71144"
},
{
"date": "2014-11-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"date": "2015-07-02T11:08:22",
"db": "PACKETSTORM",
"id": "132529"
},
{
"date": "2015-12-28T22:22:22",
"db": "PACKETSTORM",
"id": "135081"
},
{
"date": "2015-01-28T00:30:44",
"db": "PACKETSTORM",
"id": "130130"
},
{
"date": "2015-01-28T00:28:03",
"db": "PACKETSTORM",
"id": "130129"
},
{
"date": "2014-11-19T01:03:08",
"db": "PACKETSTORM",
"id": "129159"
},
{
"date": "2014-12-04T17:32:22",
"db": "PACKETSTORM",
"id": "129391"
},
{
"date": "2014-11-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201411-312"
},
{
"date": "2014-11-18T11:59:06.747000",
"db": "NVD",
"id": "CVE-2014-4459"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-07-16T00:00:00",
"db": "VULHUB",
"id": "VHN-72399"
},
{
"date": "2015-07-15T00:50:00",
"db": "BID",
"id": "71144"
},
{
"date": "2015-07-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-005515"
},
{
"date": "2019-07-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201411-312"
},
{
"date": "2024-11-21T02:10:14.300000",
"db": "NVD",
"id": "CVE-2014-4459"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201411-312"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple OS X Used in etc. Webkit Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-005515"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201411-312"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.