CVE-2015-5828
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification...
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
Exploit likelihood
What each source reports
NVD Score used
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
- Record
CVE-2015-5828- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
- Record
CVE-2015-5828- Updated
- 2026-11-02
EUVDEUVD-2015-5774 No score
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
- Record
EUVD-2015-5774- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4g2f-wf65-x5xp No score
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification...
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
- Record
GHSA-4g2f-wf65-x5xp- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2016-0116 No score
Updated webkit2 packages fix security vulnerability
The webkit2 package has been updated to version 2.10.9, fixing several security issues and other bugs.
- Record
MGASA-2016-0116- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-5828 No score
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
- Record
UBUNTU-CVE-2015-5828- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2Mageia:5 From an advisory covering 106 CVEs |
before 2.10.9-1.mga5 | 2.10.9-1.mga5 |
qtwebkit-opensource-srcUbuntu:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1 |
None known |
qtwebkit-sourceUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 |
None known |
webkitgtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5828 is a medium vulnerability (CVSS 4.3) in Apple Safari, published October 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.75%, the 78th percentile. No source names a fixed version.
References
securityfocus.com/bid/79707
lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
support.apple.com/HT205265
securitytracker.com/id/1033688
lists.apple.com/archives/security-announce/2015/Sep/msg00007.html
nvd.nist.gov/vuln/detail/CVE-2015-5828
Show 22 moreShow less
github.com/advisories/GHSA-4g2f-wf65-x5xp
advisories.mageia.org/MGASA-2016-0116.html
bugs.mageia.org/show_bug.cgi?id=17662
webkitgtk.org/security/WSA-2015-0002.html
webkitgtk.org/2015/04/14/webkitgtk2.8.1-released.html
ubuntu.com/security/CVE-2015-5828
cve.org/CVERecord?id=CVE-2015-5828