CVE-2015-3659
Last modified
CVE-2015-3659 is a vulnerability of currently unknown severity. The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.. EPSS estimates a 2.77% chance of exploitation in the next 30 days.
Description
The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apple | Iphone Os | <= 8.3 |
| Apple | Mac Os X | <= 10.10.3 |
| Apple | Safari | <= 6.2.6 |
| Apple | Safari | 7.0 |
| Apple | Safari | 7.0.1 |
| Apple | Safari | 7.0.2 |
| Apple | Safari | 7.0.3 |
| Apple | Safari | 7.0.4 |
| Apple | Safari | 7.0.5 |
| Apple | Safari | 7.0.6 |
| Apple | Safari | 7.1.0 |
| Apple | Safari | 7.1.1 |
| Apple | Safari | 7.1.2 |
| Apple | Safari | 7.1.3 |
| Apple | Safari | 7.1.4 |
| Apple | Safari | 7.1.5 |
| Apple | Safari | 7.1.6 |
| Apple | Safari | 8.0 |
| Apple | Safari | 8.0.1 |
| Apple | Safari | 8.0.2 |
| Apple | Safari | 8.0.3 |
| Apple | Safari | 8.0.4 |
| Apple | Safari | 8.0.5 |
| Apple | Safari | 8.0.6 |
References
- http://support.apple.com/kb/HT204941Vendor Advisory
- http://support.apple.com/kb/HT204950Vendor Advisory
- http://support.apple.com/kb/HT204941Vendor Advisory
- http://support.apple.com/kb/HT204950Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-3659?
How severe is CVE-2015-3659?
How do I fix CVE-2015-3659?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-3653Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5…
- CVE-2015-3654Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5…
- CVE-2015-3655Cross-site request forgery (CSRF) vulnerability in Aruba Net…8.8
- CVE-2015-3656Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5…
- CVE-2015-3657Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5…
- CVE-2015-3658The Page Loading functionality in WebKit in Apple Safari bef…
- CVE-2015-3660Cross-site scripting (XSS) vulnerability in the PDF function…
- CVE-2015-3661QT Media Foundation in Apple QuickTime before 7.7.7, as used…
- CVE-2015-3662QT Media Foundation in Apple QuickTime before 7.7.7, as used…
- CVE-2015-3663QT Media Foundation in Apple QuickTime before 7.7.7, as used…
- CVE-2015-3664QT Media Foundation in Apple QuickTime before 7.7.7 allows r…
- CVE-2015-3665QT Media Foundation in Apple QuickTime before 7.7.7 allows r…
Are you affected by CVE-2015-3659?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST