CVE-2015-2330
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a...
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
- Record
CVE-2015-2330- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
- Record
CVE-2015-2330- Updated
- 2026-11-02
EUVDEUVD-2015-2423 No score
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
- Record
EUVD-2015-2423- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5492-xcw7-p95w
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a...
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
- Record
GHSA-5492-xcw7-p95w- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2330
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
- Record
UBUNTU-CVE-2015-2330- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10461-1 No score
libjavascriptcoregtk-1_0-0-2.4.11-3.3 on GA media
These are all security issues fixed in the libjavascriptcoregtk-1_0-0-2.4.11-3.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10461-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0688-1 No score
Security update for webkitgtk
This update fixes the following security issues:
- Fix SSL connection issues with some websites after the POODLE vulnerability fix.
- Fix a crash when loading flash plugins.
- Fix build on GNU Hurd - Fix build on OS X.
- Fix documentation of webkit_print_operation_get_page_setup().
- Security fixes: CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386, CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390, CVE-2015-2330. (bnc#879607, bnc#871792)
- Pass autoreconf and enable libtool BuildRequires: Needed for above patch since it touches the buildsystem.
- Bugs fixed: boo#871792, boo#879607 and boo#879607.
- Record
SUSE-SU-2015:0688-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkitgtkSUSE:Linux Enterprise Desktop 12 From an advisory covering 9 CVEs |
before 2.4.8-16.2 | 2.4.8-16.2 |
webkitgtk3SUSE:Linux Enterprise Desktop 12 From an advisory covering 9 CVEs |
before 2.4.8-16.2 | 2.4.8-16.2 |
webkitgtkSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 9 CVEs |
before 2.4.8-16.2 | 2.4.8-16.2 |
webkitgtk3SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 9 CVEs |
before 2.4.8-16.2 | 2.4.8-16.2 |
webkitgtk3SUSE:Linux Enterprise Server 12 From an advisory covering 9 CVEs |
before 2.4.8-16.2 | 2.4.8-16.2 |
webkitgtk3SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 9 CVEs |
before 2.4.8-16.2 | 2.4.8-16.2 |
webkitgtkSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 9 CVEs |
before 2.4.8-16.2 | 2.4.8-16.2 |
webkitgtk3SUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 9 CVEs |
before 2.4.8-16.2 | 2.4.8-16.2 |
qtwebkit-opensource-srcUbuntu:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1 |
None known |
qtwebkit-sourceUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 |
None known |
webkitgtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1 |
None known |
gtk3openSUSE:Tumbleweed From an advisory covering 38 CVEs |
before 2.4.11-3.3 | 2.4.11-3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2330 is a high vulnerability (CVSS 7.5) in Webkitgtk, published March 27, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. No source names a fixed version.
References
webkitgtk.org/security/WSA-2015-0002.html
openwall.com/lists/oss-security/2015/03/17/11
bugs.webkit.org/show_bug.cgi?id=142244
trac.webkit.org/changeset/181074
security.gentoo.org/glsa/201706-15
Show 47 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-2330
github.com/advisories/GHSA-5492-xcw7-p95w
suse.com/support/update/announcement/2015/suse-su-20150688-1
bugzilla.suse.com/866728
ubuntu.com/security/CVE-2015-2330
cve.org/CVERecord?id=CVE-2015-2330