XSS in Apple Safari
CVE-2015-3660
Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.018 (75.6th percentile) — read the EPSS interpretation.
Affected products
- Apple Safari — versions 7.0, 7.0.1, 7.0.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- product-security@apple.com (x_refsource_CONFIRM, Vendor Advisory)
- product-security@apple.com (vdb-entry, x_refsource_BID)
- product-security@apple.com (vendor-advisory, x_refsource_SUSE)
- product-security@apple.com (vendor-advisory, x_refsource_APPLE, Vendor Advisory)
- product-security@apple.com (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2015-3660?
- CVE-2015-3660 is a vulnerability in Apple Safari, classified under Cross-site Scripting. Published 2015-07-03.
- Is CVE-2015-3660 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.