CVE-2015-1126 WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to...
MediumCVSS 4.3
EPSS 9.9%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple iphone os | <= 8.2 | No fix listed |
| apple Safari | <= 6.2.4 | No fix listed |
| apple Safari | = 7.0 | No fix listed |
| apple Safari | = 7.0.1 | No fix listed |
| apple Safari | = 7.0.2 | No fix listed |
| apple Safari | = 7.0.3 | No fix listed |
| apple Safari | = 7.0.4 | No fix listed |
| apple Safari | = 7.0.5 | No fix listed |
| apple Safari | = 7.0.6 | No fix listed |
| apple Safari | = 7.1.0 | No fix listed |
| apple Safari | = 7.1.1 | No fix listed |
| apple Safari | = 7.1.2 | No fix listed |
| apple Safari | = 7.1.3 | No fix listed |
| apple Safari | = 7.1.4 | No fix listed |
| apple Safari | = 8.0.0 | No fix listed |
| apple Safari | = 8.0.1 | No fix listed |
| apple Safari | = 8.0.2 | No fix listed |
| apple Safari | = 8.0.3 | No fix listed |
| apple Safari | = 8.0.4 | No fix listed |
References
- APPLE-SA-2015-04-08-1 vendor-advisory
- APPLE-SA-2015-04-08-3 vendor-advisory
- 1032047 vdb-entry
- support.apple.com vendor-advisory
- support.apple.com vendor-advisory