Unscored CVE-2015-3660 EUVD-2015-3696GHSA-3874-c4vv-qxvf

Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before …

Published Jul 3, 2015 · Updated Aug 6, 2024 · Assigned by apple

Package: qtwebkit-opensource-src Package: qtwebkit-source Package: webkitgtk Ecosystem: Ubuntu

Description

Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	webkitgtk +2	No fix yet	—

References

http://support.apple.com/kb/HT204950
75494 vdb-entry
openSUSE-SU-2016:0761 vendor-advisory
APPLE-SA-2015-06-30-4 vendor-advisory
1032754 vdb-entry