FKIE_CVE-2015-3727

Vulnerability from fkie_nvd - Published: 2015-07-03 02:00 - Updated: 2025-04-12 10:46
Severity ?
Summary
WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access an arbitrary web site's database via a crafted web site.
References
product-security@apple.comhttp://lists.apple.com/archives/security-announce/2015/Jun/msg00001.htmlVendor Advisory
product-security@apple.comhttp://lists.apple.com/archives/security-announce/2015/Jun/msg00004.htmlVendor Advisory
product-security@apple.comhttp://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
product-security@apple.comhttp://support.apple.com/kb/HT204941Vendor Advisory
product-security@apple.comhttp://support.apple.com/kb/HT204950Vendor Advisory
product-security@apple.comhttp://www.securityfocus.com/bid/75492
product-security@apple.comhttp://www.securitytracker.com/id/1032754
product-security@apple.comhttp://www.ubuntu.com/usn/USN-2937-1
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT204941Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT204950Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/75492
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1032754
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2937-1
Impacted products
Vendor Product Version
apple safari *
apple safari 7.0
apple safari 7.0.1
apple safari 7.0.2
apple safari 7.0.3
apple safari 7.0.4
apple safari 7.0.5
apple safari 7.0.6
apple safari 7.1.0
apple safari 7.1.1
apple safari 7.1.2
apple safari 7.1.3
apple safari 7.1.4
apple safari 7.1.5
apple safari 7.1.6
apple safari 8.0
apple safari 8.0.1
apple safari 8.0.2
apple safari 8.0.3
apple safari 8.0.4
apple safari 8.0.5
apple safari 8.0.6
apple iphone_os *
apple mac_os_x *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3CBE396-522D-42D2-90D8-EC816E582642",
              "versionEndIncluding": "6.2.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "88D46FE5-10D2-44A0-ACAE-CEED8BD0C30C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "391B4255-4434-4EB3-929B-3E593D9CD249",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "40B87D10-55B3-42E7-8FF6-93EDF003337D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D4EBCD8-9DD5-468E-8B5B-49E38FEBCEC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B8C7AEC-F54A-4843-A0EA-C7DD847BEF5B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "49457917-495E-4D17-A0AB-D2A163D4721D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CCADCE6-92F3-4A30-AA29-4E3394C1A3CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E74D3F4B-111E-4F51-ACB4-6725C4BF8DB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "223B13DA-9328-46C2-8426-3182D55E6669",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD636DF3-E590-4603-9D18-CC2375A97750",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0F8336F-D0F8-4337-9DF6-51B60F8A2E9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "79C2EF49-A9F0-4612-903A-A3A95805277E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E1934F2-5917-4C15-8869-82C557BF430D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:7.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3567D600-C756-4FB5-B4B1-9B014A990A7B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3587E5B7-4B66-4DB4-86A3-6E37034747C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:8.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB1C61F7-BAF4-4061-8B1A-D7F8D597F2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:8.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A5C7D83-EA9E-4E26-910D-8471252723EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:8.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE29EE2D-9EA8-4486-BC3F-B0CCF9C396F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:8.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FDB5E2A-F3BD-4500-922E-A191C45DE93C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:8.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E55F641-AC7F-41AD-BB6A-F69831DAD49E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:8.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C46A6C6-292D-4F67-9DF4-DFA01DCEA387",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB31BE7C-CB6D-447E-AFF8-618998950FC5",
              "versionEndIncluding": "8.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "68566BD8-D5DD-4747-9C9A-59154400EBFA",
              "versionEndIncluding": "10.10.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access an arbitrary web site\u0027s database via a crafted web site."
    },
    {
      "lang": "es",
      "value": "WebKit en Apple Safari anterior a 6.2.7, 7.x anterior a 7.1.7, y 8.x anterior a 8.0.7, utilizado en Apple iOS anterior a 8.4 y otros productos, no restringe correctamente las operaciones de renombramiento en las tablas WebSQL, lo que permite a atacantes remotos acceder a la base de datos de un sitio web arbitrario a trav\u00e9s de un sitio web manipulado."
    }
  ],
  "id": "CVE-2015-3727",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2015-07-03T02:00:17.913",
  "references": [
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT204941"
    },
    {
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT204950"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.securityfocus.com/bid/75492"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.securitytracker.com/id/1032754"
    },
    {
      "source": "product-security@apple.com",
      "url": "http://www.ubuntu.com/usn/USN-2937-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT204941"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://support.apple.com/kb/HT204950"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/75492"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1032754"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2937-1"
    }
  ],
  "sourceIdentifier": "product-security@apple.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.