Advisory details:
ubuntu_osv / UBUNTU-CVE-2015-3750
| Advisory ID | ubuntu_osv/UBUNTU-CVE-2015-3750 |
| Aliases |
CVE-2015-3750
|
| Summary | WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.2 |
| Risk | 3.1 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| ubuntu-priority | medium | https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3750.json |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.