Unrated
qtwebkit-opensource-src, qtwebkit-source and 1 more products — security advisory
WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
- Products
- qtwebkit-opensource-src, qtwebkit-source, webkitgtk
- Affected versions
- 2.3.2-0ubuntu10, 2.3.2-0ubuntu11, 2.4.10-0ubuntu1, 2.4.11-0ubuntu0.1, 2.4.9-2ubuntu2, 5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1
- Fixed versions
- Not specified
- CVEs
- CVE-2015-5825
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:07 UTC · Revision 1
Source evidence
WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
osv:UBUNTU-CVE-2015-5825
qtwebkit-opensource-src
Fixed versions: Not specified
qtwebkit-source
Fixed versions: Not specified
webkitgtk
Fixed versions: Not specified
Complete source record
{
"id": "4995acb70b4e285403d314092728f64affb115071ca35b98279c06677da5cf5b",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2015-5825",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2015-5825",
"summary": "WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.",
"evidence": "osv:UBUNTU-CVE-2015-5825",
"products": [
{
"name": {
"value": "qtwebkit-opensource-src",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+dfsg-1ubuntu2.1",
"evidence": "/affected/0/versions"
},
{
"value": "5.5.1+dfsg-2ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "qtwebkit-source",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.2-0ubuntu10",
"evidence": "/affected/1/versions"
},
{
"value": "2.3.2-0ubuntu11",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.9-2ubuntu2",
"evidence": "/affected/2/versions"
},
{
"value": "2.4.10-0ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "2.4.11-0ubuntu0.1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "UBUNTU-CVE-2015-5825",
"aliases": [
"UBUNTU-CVE-2015-5825"
],
"metrics": [
{
"type": "Ubuntu",
"score": "low"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebkit-opensource-src?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"5.4.2+dfsg-1ubuntu2.1",
"5.5.1+dfsg-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5825.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webkit5",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "libqt5webkit5-qmlwebkitplugin",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qml-module-qtwebkit",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qtwebkit5-doc-html",
"binary_version": "5.5.1+dfsg-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-source",
"purl": "pkg:deb/ubuntu/qtwebkit-source?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.3.2-0ubuntu10",
"2.3.2-0ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5825.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqtwebkit-qmlwebkitplugin",
"binary_version": "2.3.2-0ubuntu11"
},
{
"binary_name": "libqtwebkit4",
"binary_version": "2.3.2-0ubuntu11"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.9-2ubuntu2",
"2.4.10-0ubuntu1",
"2.4.11-0ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-5825.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
}
]
}
}
],
"modified": "2026-10-08T12:49:31.974212826Z",
"provider": "osv",
"upstream": [
"CVE-2015-5825"
],
"references": [
"https://ubuntu.com/security/CVE-2015-5825",
"https://support.apple.com/HT205212",
"https://www.cve.org/CVERecord?id=CVE-2015-5825"
]
},
"related_cves": [
{
"value": "CVE-2015-5825",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 99391,
"published_at": "2015-09-18T10:59:00+00:00"
}