CVE-2014-4465

Published: Dec 10, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element.

Affected (5)

Products: Apple: Tvos, Iphone Os, Safari

3 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Tvos	Up to 7.0.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Up to 8.1.2

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Apple Safari	Up to 6.2.0
Apple Safari	Version 7.1.0
Apple Safari	Version 8.0.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html

Source: product-security@apple.com

Vendor Advisory

http://support.apple.com/HT204245

Source: product-security@apple.com

Vendor Advisory

http://support.apple.com/HT204246

Source: product-security@apple.com

Vendor Advisory

http://support.apple.com/kb/HT6596

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html