CVE-2015-7102

WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096,...

CVE-2015-7101

WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096,...

CVE-2015-7095

WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7096, CVE-2015-7097,...

CVE-2015-7100

Technical details are not publicly available in the provided documents. The initial description mentions WebKit components affected but does not specify affected products/versions, impact, vectors, or fixes. Monitor for updates.

CVE-2015-7098

WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096,...

CVE-2015-7098

Technical details for CVE-2015-7098 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2015-7103

Technical details for CVE-2015-7103 are not publicly available in the provided connected/documents. Monitor for updates from official advisories; no confirmed affected products, exploitation status, or remediation details are provided here.

Apple iOS < 9.2 Multiple Vulnerabilities

Binary data appleios92check.nbin...

Apple Patches 50+ Vulnerabilities in iOS, OS X, Safari

Apple has piled on the patches already released by Adobe and Microsoft today, and pushed out updates for iOS, OS X, Apple TV, Safari, and it’s watch-based operating system watchOS this afternoon. Fifty-four vulnerabilities across OS X were patched Tuesday, including fixes for Mavericks v10.9.5, O...

Google Chrome Content Security Policy Access Restriction Bypass Vulnerability (CNVD-2015-07972)

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the 'CSPSource::hostMatches' function in the WebKit/Source/core/frame/csp/CSPSource.cpp file in the Content Security Policy CSP implementation of Google Chrome prior to 47.0.2526.73,...

Google Chrome 'ContainerNode::notifyNodeInsertedInternal' memory misreference vulnerability

Google Chrome is a web browser developed by the American company Google Google. A memory misreference vulnerability exists in the 'ContainerNode:: notifyNodeInsertedInternal' function in the WebKit/Source/core/dom/ContainerNode.cpp file in the DOM implementation of Google Chrome prior to version...

CVE-2015-6782

The Document::open function in WebKit/Source/core/dom/Document.cpp in Google Chrome before 47.0.2526.73 does not ensure that page-dismissal event handling is compatible with modal-dialog blocking, which makes it easier for remote attackers to spoof Omnibox content via a crafted web site...

CVE-2015-6777

Use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in WebKit/Source/core/dom/ContainerNode.cpp in the DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via...

CVE-2015-6769

The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing...

Code injection

The Document::open function in WebKit/Source/core/dom/Document.cpp in Google Chrome before 47.0.2526.73 does not ensure that page-dismissal event handling is compatible with modal-dialog blocking, which makes it easier for remote attackers to spoof Omnibox content via a crafted web site...

Design/Logic Flaw

The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing...

CVE-2015-6777

Removed by vendor...

CVE-2015-6769

CVE-2015-6769 affects Google Chrome/Chromium before 47.0.2526.73. The issue is a Same Origin Policy bypass in the core by exploiting a delay in window proxy clearing in WebKit’s WindowProxy.cpp, as reported in multiple sources (including Debian’s DSA-3415-1 and Chrome’s 47 stable release). Impact...

CVE-2015-6782

CVE-2015-6782 affects Google Chrome/Chromium up to version 47.0.2526.73, where Document::open in WebKit's DOM handling fails to align page-dismissal with modal-dialog blocking. This enables remote attackers to spoof Omnibox content via a crafted website. Connected sources confirm the vulnerabilit...

CVE-2015-6786

CVE-2015-6786 : In Chrome/Chromium, the CSPSourceList::matches function in CSP allowed a wildcard '*' to match blob:, data:, or filesystem: URLs, bypassing CSP scheme restrictions. Affects Google Chrome before 47.0.2526.73 (Chromium upstream); impact is bypass of CSP restrictions in opportunistic...