Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-7013: Safari, iTunes, iPhone OS, macOS may crash or run code

CVE-2015-7013 · published 11 years ago

Summary

The web engine used in Safari, iTunes, iPhone operating system and macOS can be tricked by a specially crafted web page to either stop working or execute unwanted program instructions. This could let an attacker take control of the computer or simply cause it to freeze. Install the latest updates from Apple to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	apple	itunes	<= 12.3.0 `cpe:2.3:a:apple:itunes::::::::`
–	apple	iphone_os	<= 9.0.2 `cpe:2.3:o:apple:iphone_os::::::::`
–	apple	mac_os_x	<= 10.11.0 `cpe:2.3:o:apple:mac_os_x::::::::`
Ubuntu:16.04:LTS	canonical	qtwebkit-opensource-src	All versions
Ubuntu:16.04:LTS	canonical	qtwebkit-source	All versions
Ubuntu:16.04:LTS	canonical	webkitgtk	All versions

Original advisory text

WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.

References

https://support.apple.com/HT205377 Third Party Advisory
https://support.apple.com/HT205372 Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Oct/msg00006.html Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Oct/msg00004.html Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
http://www.securityfocus.com/bid/77264
http://www.securitytracker.com/id/1033939
https://ubuntu.com/security/CVE-2015-7013 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2015-7013 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.8 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published23 Oct 2015

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-7013 · NVD

UBUNTU-CVE-2015-7013 · OSV

Track software like this

Free during beta