Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ubuntu_osv / UBUNTU-CVE-2015-1126
Advisory ID ubuntu_osv/UBUNTU-CVE-2015-1126
Aliases CVE-2015-1126
Summary WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.
Status Published
Exploitability 2.0
Weighted Severity 6.2
Risk 10.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
ubuntu-priority medium https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-1126.json
Reference id Reference type URL
http://lists.apple.com/archives/security-announce/2015/Apr/msg00000.html
http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html
https://support.apple.com/HT204658
https://support.apple.com/HT204661
https://ubuntu.com/security/CVE-2015-1126
https://www.cve.org/CVERecord?id=CVE-2015-1126
Data source Metasploit
Description A vulnerability exists in versions of OSX, iOS, and Windows Safari released before April 8, 2015 that allows the non-HTTPOnly cookies of any domain to be stolen.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date April 8, 2015
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.