UnratedFix available
qtwebkit-opensource-src, qtwebkit-source and 1 more products — security advisory
The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
- Products
- qtwebkit-opensource-src, qtwebkit-source, webkitgtk
- Affected versions
- 2.2.1-2ubuntu2, 2.3.2-0ubuntu10, 2.3.2-0ubuntu11, 2.3.2-1ubuntu2, 2.3.2-1ubuntu3, 2.3.2-1ubuntu4, 2.3.2-1ubuntu5, 2.3.2-1ubuntu6, 2.3.4-1ubuntu2, 2.3.90-1ubuntu1, 2.3.91-0ubuntu1, 2.4.0-1ubuntu2, 2.4.2-1ubuntu0.1, 2.4.3-1ubuntu2, 2.4.4-1~ubuntu1, 2.4.7-1~ubuntu1, 2.4.8-1ubuntu1~ubuntu14.04.1, 2.4.9-2ubuntu2, 5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1
- Fixed versions
- 2.4.10-0ubuntu0.14.04.1, 2.4.10-0ubuntu1
- CVEs
- CVE-2015-3659
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:06 UTC · Revision 1
Source evidence
The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
osv:UBUNTU-CVE-2015-3659
webkitgtk
Fixed versions: 2.4.10-0ubuntu0.14.04.1
webkitgtk
Fixed versions: 2.4.10-0ubuntu1
qtwebkit-opensource-src
Fixed versions: Not specified
qtwebkit-source
Fixed versions: Not specified
Complete source record
{
"id": "8e71a5885c5414518fde8def08fcfd5eb1d5d2308268bd5a4864c1e3b9082d52",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2015-3659",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2015-3659",
"summary": "The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.",
"evidence": "osv:UBUNTU-CVE-2015-3659",
"products": [
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.10-0ubuntu0.14.04.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "2.2.1-2ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu3",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu4",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu5",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu6",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.4-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.90-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.91-0ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.0-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.2-1ubuntu0.1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.3-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.4-1~ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.7-1~ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.8-1ubuntu1~ubuntu14.04.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.10-0ubuntu1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "2.4.9-2ubuntu2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "qtwebkit-opensource-src",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+dfsg-1ubuntu2.1",
"evidence": "/affected/2/versions"
},
{
"value": "5.5.1+dfsg-2ubuntu1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "qtwebkit-source",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.2-0ubuntu10",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.2-0ubuntu11",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "UBUNTU-CVE-2015-3659",
"aliases": [
"UBUNTU-CVE-2015-3659"
],
"metrics": [
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.10-0ubuntu0.14.04.1"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"2.2.1-2ubuntu2",
"2.3.2-1ubuntu2",
"2.3.2-1ubuntu3",
"2.3.2-1ubuntu4",
"2.3.2-1ubuntu5",
"2.3.2-1ubuntu6",
"2.3.4-1ubuntu2",
"2.3.90-1ubuntu1",
"2.3.91-0ubuntu1",
"2.4.0-1ubuntu2",
"2.4.2-1ubuntu0.1",
"2.4.3-1ubuntu2",
"2.4.4-1~ubuntu1",
"2.4.7-1~ubuntu1",
"2.4.8-1ubuntu1~ubuntu14.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3659.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-1.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit-1.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.10-0ubuntu1"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.9-2ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3659.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.10-0ubuntu1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebkit-opensource-src?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"5.4.2+dfsg-1ubuntu2.1",
"5.5.1+dfsg-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3659.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webkit5",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "libqt5webkit5-qmlwebkitplugin",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qml-module-qtwebkit",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qtwebkit5-doc-html",
"binary_version": "5.5.1+dfsg-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-source",
"purl": "pkg:deb/ubuntu/qtwebkit-source?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.3.2-0ubuntu10",
"2.3.2-0ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3659.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqtwebkit-qmlwebkitplugin",
"binary_version": "2.3.2-0ubuntu11"
},
{
"binary_name": "libqtwebkit4",
"binary_version": "2.3.2-0ubuntu11"
}
]
}
}
],
"modified": "2026-10-08T12:48:42.716875575Z",
"provider": "osv",
"upstream": [
"CVE-2015-3659"
],
"references": [
"https://ubuntu.com/security/CVE-2015-3659",
"https://ubuntu.com/security/notices/USN-2937-1",
"https://www.cve.org/CVERecord?id=CVE-2015-3659"
]
},
"related_cves": [
{
"value": "CVE-2015-3659",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 99297,
"published_at": "2015-07-02T00:00:00+00:00"
}