SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Apple Safari Vendors:   Apple
Apple Safari Flaws Let Remote Users Bypass Security Controls, Obtain Potentially Sensitive Information, Spoof Interfaces and URLS, and Execute Arbitrary Code
SecurityTracker Alert ID:  1033274
SecurityTracker URL:  http://securitytracker.com/id/1033274
CVE Reference:   CVE-2015-3729, CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-3750, CVE-2015-3751, CVE-2015-3752, CVE-2015-3753, CVE-2015-3754, CVE-2015-3755   (Links to External Site)
Date:  Aug 13 2015
Impact:   Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to versions 6.2.8, 7.1.8, 8.0.8
Description:   Multiple vulnerabilities were reported in Apple Safari. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can bypass security controls on the target system. A remote user can obtain potentially sensitive information on the target system. A remote user can spoof the user interface. A remote user can spoof URLs.

A remote user can create a specially crafted file that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code on the target system [CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749].

A remote user can create a specially crafted web site that, when loaded by the target user, will spoof the user interface [CVE-2015-3729].

A remote web server can cause the target browser to fail to use HTTP Strict Transport Security for Content Security Policy reports [CVE-2015-3750].

A remote server with video controls can load images nested in object elements in violation of the Content Security Policy for that server [CVE-2015-3751].

A remote user can obtain cookies from a different domain via a Content Security Policy report [CVE-2015-3752].

A remote server can access image data from a different domain [CVE-2015-3753].

Authentication data from private browsing mode may be cached during non-private mode browsing [CVE-2015-3754]. As a result, part of the target user's private browsing history may be exposed.

A remote user can create a specially crafted URL that, when loaded by the target user, will allow the web site to display an arbitrary URL [CVE-2015-3755].

Code Audit Labs of VulnHunt.com, Muneaki Nishimura (nishimunea), Antonio Sanso and Damien Antipa of Adobe, xisigr of Tencent's Xuanwu Lab, and Dongsung Kim (@kid1ng) reported these vulnerabilities.

Impact:   A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.

A remote user can bypass security controls on the target system.

A remote user can obtain potentially sensitive information on the target system.

A remote user can spoof the user interface.

A remote user can spoof a URL.

Solution:   The vendor has issued a fix (6.2.8, 7.1.8, 8.0.8).

The vendor's advisory is available at:

https://support.apple.com/kb/HT205033

Vendor URL:  support.apple.com/kb/HT205033 (Links to External Site)
Cause:   Access control error, Authentication error, Input validation error
Underlying OS:  UNIX (macOS/OS X)
Underlying OS Comments:  10.8.5, 10.9.5, 10.10.4

Message History:   This archive entry has one or more follow-up message(s) listed below.
Sep 16 2015 (Apple Issues Fix for Apple iTunes) Apple Safari Flaws Let Remote Users Bypass Security Controls, Obtain Potentially Sensitive Information, Spoof Interfaces and URLS, and Execute Arbitrary Code
Apple has issued a fix for Apple iTunes for Windows.
Feb 25 2016 (Apple Issues Fix for Apple TV) Apple Safari Flaws Let Remote Users Bypass Security Controls, Obtain Potentially Sensitive Information, Spoof Interfaces and URLS, and Execute Arbitrary Code
Apple has issued a fix for Apple TV.



 Source Message Contents

Subject:  APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2015-08-13-1 Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8

Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 is now available and
addresses the following:

Safari Application
Available for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.4
Impact:  Visiting a malicious website may lead to user interface
spoofing
Description:  A malicious website could open another site and prompt
for user input without a way for the user to tell where the prompt
came from. The issue was addressed by displaying the prompt origin to
the user.
CVE-ID
CVE-2015-3729 : Code Audit Labs of VulnHunt.com

WebKit
Available for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.4
Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description:  Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2015-3730 : Apple
CVE-2015-3731 : Apple
CVE-2015-3732 : Apple
CVE-2015-3733 : Apple
CVE-2015-3734 : Apple
CVE-2015-3735 : Apple
CVE-2015-3736 : Apple
CVE-2015-3737 : Apple
CVE-2015-3738 : Apple
CVE-2015-3739 : Apple
CVE-2015-3740 : Apple
CVE-2015-3741 : Apple
CVE-2015-3742 : Apple
CVE-2015-3743 : Apple
CVE-2015-3744 : Apple
CVE-2015-3745 : Apple
CVE-2015-3746 : Apple
CVE-2015-3747 : Apple
CVE-2015-3748 : Apple
CVE-2015-3749 : Apple

WebKit
Available for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.4
Impact:  A malicious website may trigger plaintext requests to an
origin under HTTP Strict Transport Security
Description:  An issue existed where Content Security Policy report
requests would not honor HTTP Strict Transport Security. This issue
was addressed through improved HTTP Strict Transport Security
enforcement.
CVE-ID
CVE-2015-3750 : Muneaki Nishimura (nishimunea)

WebKit
Available for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.4
Impact:  Image loading may violate a website's Content Security
Policy directive
Description:  An issue existed where websites with video controls
would load images nested in object elements in violation of the
website's Content Security Policy directive. This issue was addressed
through improved Content Security Policy enforcement.
CVE-ID
CVE-2015-3751 : Muneaki Nishimura (nishimunea)

WebKit
Available for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.4
Impact:  Content Security Policy report requests may leak cookies
Description:  Two issues existed in how cookies were added to Content
Security Policy report requests. Cookies were sent in cross-origin
report requests in violation of the standard. Cookies set during
regular browsing were sent in private browsing. These issues were
addressed through improved cookie handling.
CVE-ID
CVE-2015-3752 : Muneaki Nishimura (nishimunea)

WebKit Canvas
Available for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.4
Impact:  A malicious website may exfiltrate image data cross-origin
Description:  Images fetched through URLs that redirected to a
data:image resource could have been exfiltrated cross-origin. This
issue was addressed through improved canvas taint tracking.
CVE-ID
CVE-2015-3753 : Antonio Sanso and Damien Antipa of Adobe

WebKit Page Loading
Available for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.4
Impact:  Cached authentication state may reveal private browsing
history
Description:  An issue existed in caching of HTTP authentication.
Credentials entered in private browsing mode were carried over to
regular browsing which would reveal parts of the user's private
browsing history. This issue was addressed through improved caching
restrictions.
CVE-ID
CVE-2015-3754 : Dongsung Kim (@kid1ng)

WebKit Process Model
Available for:  OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.4
Impact:  Visiting a malicious website may lead to user interface
spoofing
Description:  Navigating to a malformed URL may have allowed a
malicious website to display an arbitrary URL. This issue was
addressed through improved URL handling.
CVE-ID
CVE-2015-3755 : xisigr of Tencent's Xuanwu Lab

Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 may be obtained from
the Mac App Store.

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCAAGBQJVzM3yAAoJEBcWfLTuOo7tYZcP/1LnHEMuFI+SqUczpBZssu+S
k5VHU4YHg37SVeGXWPYhmWnz1NG+t3h5UZmPKwupqHWgA1JbzRcUAEozBLt6kHoL
V8FQJPdiMNHwuqvgHlE8YK8Z9Ep3bS0bvVr/EyE/QghaJxi9IUXGZPNQt5ikP2LA
ZafmMrgQF5GRyYeaWsOw12tEiD/wc9f6ThMwtgsOW8LyjTLwf7qPt084sxj2XLTC
GZym1TPjlu6FodGk2ZCSP1a4WwHljBjXyaUlRGvxmAJi+aEe9frCg7onvMrkFdD8
CBCNBXswpMfAg759ZvPjLvYYYgTkql3CGxFOAiNjs47y3kzo/1kXCrrGtqDhgQ0G
MNzmf23yipHoA63UwbmHuANCjPb1+M98uCQJ+jEW3dqpLcJGTbsZil5w1aPJXb5s
ulIu9FGknArxrutsg2Zt3xbd3CPaqShWXq2NDNDaofjQ05KkvdqhhMeDUkdujgbT
VNbewci+OfDA6puc8tplZrHWa+BUiOlk9g4UXiUhwzhcj86sGF2FJIDqAEDlBdIo
rpnVNjrNx6bvDA/5WEj40oUPF+yuFNRVHQhKmu++zhXEE8kjtaGXZr+3YiZoCEWl
HKY9pBlZmEO2Viq+Xn+M1OIS091h3qbVC93Eho2oiF/ttcmLPRL40dJmNwaZKe/4
G892+OR68K28IWb8iUib
=l5e/
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC