Unrated
qtwebkit-opensource-src, qtwebkit-source and 1 more products — security advisory
Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
- Products
- qtwebkit-opensource-src, qtwebkit-source, webkitgtk
- Affected versions
- 2.3.2-0ubuntu10, 2.3.2-0ubuntu11, 2.4.10-0ubuntu1, 2.4.11-0ubuntu0.1, 2.4.9-2ubuntu2, 5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1
- Fixed versions
- Not specified
- CVEs
- CVE-2015-3660
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:06 UTC · Revision 1
Source evidence
Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
osv:UBUNTU-CVE-2015-3660
qtwebkit-opensource-src
Fixed versions: Not specified
qtwebkit-source
Fixed versions: Not specified
webkitgtk
Fixed versions: Not specified
Complete source record
{
"id": "2c89073b49c528e26f4149fdc0d99db8b1110e8a255d8a78e4375980b1cd0095",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2015-3660",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2015-3660",
"summary": "Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.",
"evidence": "osv:UBUNTU-CVE-2015-3660",
"products": [
{
"name": {
"value": "qtwebkit-opensource-src",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+dfsg-1ubuntu2.1",
"evidence": "/affected/0/versions"
},
{
"value": "5.5.1+dfsg-2ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "qtwebkit-source",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.2-0ubuntu10",
"evidence": "/affected/1/versions"
},
{
"value": "2.3.2-0ubuntu11",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.9-2ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "2.4.10-0ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "2.4.11-0ubuntu0.1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "UBUNTU-CVE-2015-3660",
"aliases": [
"UBUNTU-CVE-2015-3660"
],
"metrics": [
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebkit-opensource-src?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"5.4.2+dfsg-1ubuntu2.1",
"5.5.1+dfsg-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3660.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webkit5",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "libqt5webkit5-qmlwebkitplugin",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qml-module-qtwebkit",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qtwebkit5-doc-html",
"binary_version": "5.5.1+dfsg-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-source",
"purl": "pkg:deb/ubuntu/qtwebkit-source?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.3.2-0ubuntu10",
"2.3.2-0ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3660.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqtwebkit-qmlwebkitplugin",
"binary_version": "2.3.2-0ubuntu11"
},
{
"binary_name": "libqtwebkit4",
"binary_version": "2.3.2-0ubuntu11"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.9-2ubuntu2",
"2.4.10-0ubuntu1",
"2.4.11-0ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3660.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
}
]
}
}
],
"modified": "2026-10-08T12:48:56.430912533Z",
"provider": "osv",
"upstream": [
"CVE-2015-3660"
],
"references": [
"https://ubuntu.com/security/CVE-2015-3660",
"https://www.cve.org/CVERecord?id=CVE-2015-3660"
]
},
"related_cves": [
{
"value": "CVE-2015-3660",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 99331,
"published_at": "2015-07-03T01:59:00+00:00"
}