UnratedFix available
qtwebkit-opensource-src, qtwebkit-source and 1 more products — security advisory
The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.
- Products
- qtwebkit-opensource-src, qtwebkit-source, webkitgtk
- Affected versions
- 2.2.1-2ubuntu2, 2.3.2-0ubuntu10, 2.3.2-0ubuntu11, 2.3.2-1ubuntu2, 2.3.2-1ubuntu3, 2.3.2-1ubuntu4, 2.3.2-1ubuntu5, 2.3.2-1ubuntu6, 2.3.4-1ubuntu2, 2.3.90-1ubuntu1, 2.3.91-0ubuntu1, 2.4.0-1ubuntu2, 2.4.2-1ubuntu0.1, 2.4.3-1ubuntu2, 2.4.4-1~ubuntu1, 2.4.7-1~ubuntu1, 2.4.8-1ubuntu1~ubuntu14.04.1, 2.4.9-2ubuntu2, 5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1
- Fixed versions
- 2.4.10-0ubuntu0.14.04.1, 2.4.10-0ubuntu1
- CVEs
- CVE-2015-3658
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:06 UTC · Revision 1
Source evidence
The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.
osv:UBUNTU-CVE-2015-3658
webkitgtk
Fixed versions: 2.4.10-0ubuntu0.14.04.1
webkitgtk
Fixed versions: 2.4.10-0ubuntu1
qtwebkit-opensource-src
Fixed versions: Not specified
qtwebkit-source
Fixed versions: Not specified
Complete source record
{
"id": "3747a71c1c67a668d2578840905c47ef22f73e7546b583769f812d1f71202742",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2015-3658",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2015-3658",
"summary": "The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.",
"evidence": "osv:UBUNTU-CVE-2015-3658",
"products": [
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.10-0ubuntu0.14.04.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "2.2.1-2ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu3",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu4",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu5",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.2-1ubuntu6",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.4-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.90-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.3.91-0ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.0-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.2-1ubuntu0.1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.3-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.4-1~ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.7-1~ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.8-1ubuntu1~ubuntu14.04.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.10-0ubuntu1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "2.4.9-2ubuntu2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "qtwebkit-opensource-src",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+dfsg-1ubuntu2.1",
"evidence": "/affected/2/versions"
},
{
"value": "5.5.1+dfsg-2ubuntu1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "qtwebkit-source",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.2-0ubuntu10",
"evidence": "/affected/3/versions"
},
{
"value": "2.3.2-0ubuntu11",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "UBUNTU-CVE-2015-3658",
"aliases": [
"UBUNTU-CVE-2015-3658"
],
"metrics": [
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.10-0ubuntu0.14.04.1"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"2.2.1-2ubuntu2",
"2.3.2-1ubuntu2",
"2.3.2-1ubuntu3",
"2.3.2-1ubuntu4",
"2.3.2-1ubuntu5",
"2.3.2-1ubuntu6",
"2.3.4-1ubuntu2",
"2.3.90-1ubuntu1",
"2.3.91-0ubuntu1",
"2.4.0-1ubuntu2",
"2.4.2-1ubuntu0.1",
"2.4.3-1ubuntu2",
"2.4.4-1~ubuntu1",
"2.4.7-1~ubuntu1",
"2.4.8-1ubuntu1~ubuntu14.04.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3658.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-1.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit-1.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.10-0ubuntu0.14.04.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.10-0ubuntu1"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.9-2ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3658.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.10-0ubuntu1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.10-0ubuntu1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebkit-opensource-src?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"5.4.2+dfsg-1ubuntu2.1",
"5.5.1+dfsg-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3658.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webkit5",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "libqt5webkit5-qmlwebkitplugin",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qml-module-qtwebkit",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qtwebkit5-doc-html",
"binary_version": "5.5.1+dfsg-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-source",
"purl": "pkg:deb/ubuntu/qtwebkit-source?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.3.2-0ubuntu10",
"2.3.2-0ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3658.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqtwebkit-qmlwebkitplugin",
"binary_version": "2.3.2-0ubuntu11"
},
{
"binary_name": "libqtwebkit4",
"binary_version": "2.3.2-0ubuntu11"
}
]
}
}
],
"modified": "2026-10-08T12:48:43.207430064Z",
"provider": "osv",
"upstream": [
"CVE-2015-3658"
],
"references": [
"https://ubuntu.com/security/CVE-2015-3658",
"https://ubuntu.com/security/notices/USN-2937-1",
"https://www.cve.org/CVERecord?id=CVE-2015-3658"
]
},
"related_cves": [
{
"value": "CVE-2015-3658",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 99299,
"published_at": "2015-07-02T00:00:00+00:00"
}