CVE-2015-3755

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-08-16 · updated 2026-06-17
Weakness: CWE-254

Description

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.

Affected products

Apple Iphone Os: before 8.4.1 — fixed in 8.4.1
Apple Safari: from 6.0 before 6.2.8; from 7.0 before 7.1.8; from 8.0 before 8.0.8 — fixed in 6.2.8, 7.1.8, 8.0.8

How to fix

Upgrade to a fixed version: Apple Iphone Os 8.4.1; Apple Safari 6.2.8, 7.1.8, 8.0.8. Check the vendor advisory for mitigations.

References

http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html
http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
http://www.securityfocus.com/bid/76344
http://www.securitytracker.com/id/1033274
https://support.apple.com/kb/HT205030
https://support.apple.com/kb/HT205033
http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html
http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
http://www.securityfocus.com/bid/76344
http://www.securitytracker.com/id/1033274

Get alerted when CVE-2015-3755 or the next vulnerability affects your stack