CVE-2015-1156

2015-05-0800:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.004

Percentile

71.9%

JSON

The page-loading implementation in WebKit, as used in Apple Safari before
6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the
rel attribute in an A element, which allows remote attackers to bypass the
Same Origin Policy for a link’s target, and spoof the user interface, via a
crafted web site.

Notes

Author	Note
jdstrand	webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8