CVE-2015-5825
published 2015-09-18CVE-2015-5825: WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive…
PriorityP421medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
2.02%
79.0th percentile
WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_9 | — | — |
| apple | iphone_os | <= 8.4.1 | — |
| apple | safari | <= 8.0.8 | — |
| apple | safari_9 | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2015-5825: iOS 9
vendor_apple·CVSS 4.3
CVE-2015-5825 [MEDIUM] CVE-2015-5825: iOS 9
Apple Security Update: About the security content of iOS 9
Product: iOS 9
CVE: CVE-2015-5825
Component: CVE-ID
Apple
CVE-2015-5825: Safari 9
vendor_apple·CVSS 4.3
CVE-2015-5825 [MEDIUM] CVE-2015-5825: Safari 9
Apple Security Update: About the security content of Safari 9
Product: Safari 9
CVE: CVE-2015-5825
Component: CVE-ID
GHSA
GHSA-hv69-h9mv-592v: WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive i
ghsa_unreviewed·2022-05-17
CVE-2015-5825 [MEDIUM] CWE-200 GHSA-hv69-h9mv-592v: WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive i
WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
OSV
CVE-2015-5825: WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive i
osv·2015-09-18·CVSS 4.3
CVE-2015-5825 [MEDIUM] CVE-2015-5825: WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive i
WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
No detection rules found.
No public exploits indexed.
http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00007.htmlhttp://lists.opensuse.org/opensuse-updates/2016-03/msg00054.htmlhttp://www.securityfocus.com/bid/76766http://www.securitytracker.com/id/1033609https://support.apple.com/HT205212https://support.apple.com/HT205265http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00007.htmlhttp://lists.opensuse.org/opensuse-updates/2016-03/msg00054.htmlhttp://www.securityfocus.com/bid/76766http://www.securitytracker.com/id/1033609https://support.apple.com/HT205212https://support.apple.com/HT205265
2015-09-18
Published