CVE-2015-3659
Apple iPhone OS < 8.3 and Safari < 6.2.6 - Remote Code Execution via SQLite Authorizer Bypass
Title source: manualDescription
The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
References (8)
Core 8
Core References
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT204941
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT204950
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/75492
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
Vendor Advisory vendor-advisory
x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
Vendor Advisory vendor-advisory
x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1032754
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2937-1
Scores
EPSS
0.0277
EPSS Percentile
84.8%
Details
CWE
CWE-264
Status
published
Products (24)
apple/iphone_os
< 8.3
apple/mac_os_x
< 10.10.3
apple/safari
7.0
apple/safari
7.0.1
apple/safari
7.0.2
apple/safari
7.0.3
apple/safari
7.0.4
apple/safari
7.0.5
apple/safari
7.0.6
apple/safari
7.1.0
... and 14 more
Published
Jul 03, 2015
Tracked Since
Feb 18, 2026