Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2015-3749: Safari and iPhone OS Web engine can run malicious code
CVE-2015-3749 · published 11 years ago
Summary
Web pages crafted in a certain way can make the Web engine in Safari and the iPhone operating system run unwanted code or crash the app, potentially letting an attacker take control or cause downtime. This affects iOS versions before 8.4.1 and Safari versions before 6.2.8, 7.1.8, and 8.0.8. Update your devices and browsers to the latest versions as soon as possible to protect against this risk.
What to do
- Update canonical webkitgtk to version 2.4.10-0ubuntu0.14.04.1.
- Update canonical webkitgtk to version 2.4.10-0ubuntu1.
- Update apple iphone_os to version 8.4.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apple | itunes |
<= 12.2 cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:* |
| – | apple | safari |
>= 6.0, < 6.2.8 >= 7.0, < 7.1.8 >= 8.0, < 8.0.8 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | iphone_os |
< 8.4.1 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
14.04 15.10 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* |
| Ubuntu:14.04:LTS | canonical | webkitgtk |
< 2.4.10-0ubuntu0.14.04.1 Fix: upgrade to 2.4.10-0ubuntu0.14.04.1
|
| Ubuntu:16.04:LTS | canonical | webkitgtk |
< 2.4.10-0ubuntu1 Fix: upgrade to 2.4.10-0ubuntu1
|
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
Original advisory text
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory cor...
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
References
- https://ubuntu.com/security/CVE-2015-3749 Third Party Advisory
- https://ubuntu.com/security/notices/USN-2937-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2015-3749 Third Party Advisory
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html Mailing List Patch Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html Mailing List Third Party Advisory
- http://www.securityfocus.com/bid/76338 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1033274 Third Party Advisory VDB Entry
- http://www.ubuntu.com/usn/USN-2937-1 Third Party Advisory
- https://support.apple.com/HT205221 Vendor Advisory
- https://support.apple.com/kb/HT205033 Third Party Advisory
- https://support.apple.com/kb/HT205030 Third Party Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Third Party Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.8
Medium
Type
CWE-119Buffer Overflow
Timeline
Published16 Aug 2015
Updated30 Oct 2026
First seen29 Sep 2026
Track software like this
Free during beta