CVE-2015-1126 Other in n/a
Remote attackers can trigger incorrect resource access in WebKit via malicious FTP URLs, affecting Safari and iOS users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-1126?
CVE-2015-1126 is a medium-severity vulnerability in Apple Iphone Os, published on 10 Apr 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.
Weakness: CWE-20
Which versions are affected by CVE-2015-1126?
It affects 2 products.
Products include Apple Iphone Os, Apple Safari.
How do I fix CVE-2015-1126?
Upgrade to a fixed version.
Is CVE-2015-1126 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-1126 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Apple Iphone Os
Sources
Also known as GHSA-r4c3-86wx-hvpp, UBUNTU-CVE-2015-1126.