CVE-2015-3750

2015-08-1600:00:00

ubuntu.com

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

0.003

Percentile

69.8%

JSON

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before
8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the
HTTP Strict Transport Security (HSTS) protection mechanism for Content
Security Policy (CSP) report requests, which allows man-in-the-middle
attackers to obtain sensitive information by sniffing the network or spoof
a report by modifying the client-server data stream.

Notes

Author	Note
jdstrand	webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8