UnratedFix available
qtwebkit-opensource-src, qtwebkit-source and 1 more products — security advisory
WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
- Products
- qtwebkit-opensource-src, qtwebkit-source, webkitgtk
- Affected versions
- 2.2.1-2ubuntu2, 2.3.2-0ubuntu10, 2.3.2-0ubuntu11, 2.3.2-1ubuntu2, 2.3.2-1ubuntu3, 2.3.2-1ubuntu4, 2.3.2-1ubuntu5, 2.3.2-1ubuntu6, 2.3.4-1ubuntu2, 2.3.90-1ubuntu1, 2.3.91-0ubuntu1, 2.4.0-1ubuntu2, 2.4.2-1ubuntu0.1, 2.4.3-1ubuntu2, 2.4.4-1~ubuntu1, 2.4.7-1~ubuntu1, 2.4.8-1ubuntu1~ubuntu14.04.1, 2.4.9-2ubuntu2, 5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1
- Fixed versions
- 2.4.10-0ubuntu0.14.04.1, 2.4.10-0ubuntu1
- CVEs
- CVE-2015-1120
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:06 UTC · Revision 1
Source evidence
WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
osv:UBUNTU-CVE-2015-1120
webkitgtk
Fixed versions: 2.4.10-0ubuntu0.14.04.1
webkitgtk
Fixed versions: 2.4.10-0ubuntu1
qtwebkit-opensource-src
Fixed versions: Not specified
qtwebkit-source
Fixed versions: Not specified
Complete source record
{
"id": "f43e3dce435eebfa018b072e080125f50f0c7926ea86b7e6b8fbe685e3a4b489",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2015-1120",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2015-1120",
"summary": "WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.",
"evidence": "osv:UBUNTU-CVE-2015-1120",
"products": [
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.10-0ubuntu0.14.04.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "2.2.1-2ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu3",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu4",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu5",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu6",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.4-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.90-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.91-0ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.0-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.2-1ubuntu0.1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.3-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.4-1~ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.7-1~ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.8-1ubuntu1~ubuntu14.04.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.10-0ubuntu1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "2.4.9-2ubuntu2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "qtwebkit-opensource-src",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+dfsg-1ubuntu2.1",
"evidence": "/affected/2/versions"
},
{
"value": "5.5.1+dfsg-2ubuntu1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "qtwebkit-source",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.2-0ubuntu10",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.2-0ubuntu11",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "UBUNTU-CVE-2015-1120",
"aliases": [
"UBUNTU-CVE-2015-1120"
],
"metrics": [
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.10-0ubuntu0.14.04.1"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"2.2.1-2ubuntu2",
"2.3.2-1ubuntu2",
"2.3.2-1ubuntu3",
"2.3.2-1ubuntu4",
"2.3.2-1ubuntu5",
"2.3.2-1ubuntu6",
"2.3.4-1ubuntu2",
"2.3.90-1ubuntu1",
"2.3.91-0ubuntu1",
"2.4.0-1ubuntu2",
"2.4.2-1ubuntu0.1",
"2.4.3-1ubuntu2",
"2.4.4-1~ubuntu1",
"2.4.7-1~ubuntu1",
"2.4.8-1ubuntu1~ubuntu14.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-1120.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-1.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit-1.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.10-0ubuntu1"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.9-2ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-1120.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.10-0ubuntu1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebkit-opensource-src?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"5.4.2+dfsg-1ubuntu2.1",
"5.5.1+dfsg-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-1120.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webkit5",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "libqt5webkit5-qmlwebkitplugin",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qml-module-qtwebkit",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qtwebkit5-doc-html",
"binary_version": "5.5.1+dfsg-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-source",
"purl": "pkg:deb/ubuntu/qtwebkit-source?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.3.2-0ubuntu10",
"2.3.2-0ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-1120.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqtwebkit-qmlwebkitplugin",
"binary_version": "2.3.2-0ubuntu11"
},
{
"binary_name": "libqtwebkit4",
"binary_version": "2.3.2-0ubuntu11"
}
]
}
}
],
"modified": "2026-10-08T12:48:43.164048114Z",
"provider": "osv",
"upstream": [
"CVE-2015-1120"
],
"references": [
"https://ubuntu.com/security/CVE-2015-1120",
"https://support.apple.com/HT204662",
"https://support.apple.com/HT204661",
"https://support.apple.com/HT204658",
"https://ubuntu.com/security/notices/USN-2937-1",
"https://www.cve.org/CVERecord?id=CVE-2015-1120"
]
},
"related_cves": [
{
"value": "CVE-2015-1120",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 99301,
"published_at": "2015-04-10T00:00:00+00:00"
}