The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Safari | — | Upgrade to Apple Safari version 9Uninstall Apple Safari on Windows | Dec 5, 2016 | Oct 9, 2015 |
| Suse | — | Upgrade webkit2gtk3-develUpgrade libjavascriptcoregtk-4_0-18-debuginfoUpgrade libwebkit2gtk-4_0-37-debuginfo-32bitUpgrade webkit2gtk-4_0-injected-bundles-debuginfoUpgrade libwebkit2gtk-4_0-37-debuginfoUpgrade typelib-1_0-webkit2-4_0Upgrade webkit-jsc-4Upgrade typelib-1_0-webkit2webextension-4_0Upgrade libwebkit2gtk-4_0-37Upgrade libjavascriptcoregtk-4_0-18Upgrade webkit2gtk3-debugsourceUpgrade libwebkit2gtk-4_0-37-32bitUpgrade webkit-jsc-4-debuginfoUpgrade libwebkit2gtk3-langUpgrade typelib-1_0-javascriptcore-4_0Upgrade libjavascriptcoregtk-4_0-18-debuginfo-32bitUpgrade webkit2gtk-4_0-injected-bundlesUpgrade libjavascriptcoregtk-4_0-18-32bit | Mar 22, 2016 | Oct 9, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub