Unrated
qtwebkit-opensource-src, qtwebkit-source and 1 more products — security advisory
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
- Products
- qtwebkit-opensource-src, qtwebkit-source, webkitgtk
- Affected versions
- 2.3.2-0ubuntu10, 2.3.2-0ubuntu11, 2.4.10-0ubuntu1, 2.4.11-0ubuntu0.1, 2.4.9-2ubuntu2, 5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1
- Fixed versions
- Not specified
- CVEs
- CVE-2015-3753
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:06 UTC · Revision 1
Source evidence
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
osv:UBUNTU-CVE-2015-3753
qtwebkit-opensource-src
Fixed versions: Not specified
qtwebkit-source
Fixed versions: Not specified
webkitgtk
Fixed versions: Not specified
Complete source record
{
"id": "72c6aa6df0ced069a02fd93fa8926b3436a13e4661f33c648583ec373628561e",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2015-3753",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2015-3753",
"summary": "WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.",
"evidence": "osv:UBUNTU-CVE-2015-3753",
"products": [
{
"name": {
"value": "qtwebkit-opensource-src",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+dfsg-1ubuntu2.1",
"evidence": "/affected/0/versions"
},
{
"value": "5.5.1+dfsg-2ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "qtwebkit-source",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.2-0ubuntu10",
"evidence": "/affected/1/versions"
},
{
"value": "2.3.2-0ubuntu11",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.9-2ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "2.4.10-0ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "2.4.11-0ubuntu0.1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "UBUNTU-CVE-2015-3753",
"aliases": [
"UBUNTU-CVE-2015-3753"
],
"metrics": [
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebkit-opensource-src?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"5.4.2+dfsg-1ubuntu2.1",
"5.5.1+dfsg-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3753.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webkit5",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "libqt5webkit5-qmlwebkitplugin",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qml-module-qtwebkit",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qtwebkit5-doc-html",
"binary_version": "5.5.1+dfsg-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-source",
"purl": "pkg:deb/ubuntu/qtwebkit-source?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.3.2-0ubuntu10",
"2.3.2-0ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3753.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqtwebkit-qmlwebkitplugin",
"binary_version": "2.3.2-0ubuntu11"
},
{
"binary_name": "libqtwebkit4",
"binary_version": "2.3.2-0ubuntu11"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.9-2ubuntu2",
"2.4.10-0ubuntu1",
"2.4.11-0ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3753.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
}
]
}
}
],
"modified": "2026-10-08T12:49:08.215820977Z",
"provider": "osv",
"upstream": [
"CVE-2015-3753"
],
"references": [
"https://ubuntu.com/security/CVE-2015-3753",
"https://support.apple.com/kb/HT205033",
"https://support.apple.com/kb/HT205030",
"https://www.cve.org/CVERecord?id=CVE-2015-3753"
]
},
"related_cves": [
{
"value": "CVE-2015-3753",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 99344,
"published_at": "2015-08-16T23:59:00+00:00"
}