CVE-2015-3753

2015-08-1600:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

70.6%

JSON

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before
8.0.8, as used in iOS before 8.4.1 and other products, does not properly
perform taint checking for CANVAS elements, which allows remote attackers
to bypass the Same Origin Policy and obtain sensitive image data by
leveraging a redirect to a data:image resource.

Notes

Author	Note
jdstrand	webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8