CVEvulnerability
CVE-2014-4465
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-12-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element.
Affected configurations
• apple tvos (<= 7.0.1)
• apple iphone os (<= 8.1.2)
• apple safari (<= 6.2.0)
• apple safari 7.1.0
• apple safari 8.0.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html Vendor Advisory
- http://support.apple.com/HT204245 Vendor Advisory
- http://support.apple.com/HT204246 Vendor Advisory
- http://support.apple.com/kb/HT6596 Vendor Advisory
- http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html Vendor Advisory
- http://support.apple.com/HT204245 Vendor Advisory
- http://support.apple.com/HT204246 Vendor Advisory
- http://support.apple.com/kb/HT6596 Vendor Advisory