{"id":"CVE-2015-3754","aliases":["EUVD-2015-3790","GHSA-vcw5-5m6w-mgw3","MGASA-2016-0116","UBUNTU-CVE-2015-3754"],"status":"published","title":"The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and...","description":"The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01935,"percentile":0.80195,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2015-08-16T23:00:00Z","modified":"2026-10-08T12:49:09Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"webkit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-1.mga5"}]}],"bundled":106},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-1ubuntu2.1","5.5.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu10","2.3.2-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]}],"products":[{"vendor":"apple","product":"safari"}],"references":[{"url":"http://www.securitytracker.com/id/1033274","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/76339","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory","report"]},{"url":"https://support.apple.com/kb/HT205033","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3754"},{"url":"https://github.com/advisories/GHSA-vcw5-5m6w-mgw3"},{"url":"https://advisories.mageia.org/MGASA-2016-0116.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17662","tags":["report"]},{"url":"http://webkitgtk.org/security/WSA-2015-0002.html","tags":["web"]},{"url":"http://webkitgtk.org/security/WSA-2016-0001.html","tags":["web"]},{"url":"http://webkitgtk.org/security/WSA-2016-0002.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/04/14/webkitgtk2.8.1-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/05/12/webkitgtk2.8.2-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/07/08/webkitgtk2.8.4-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/08/06/webkitgtk2.8.5-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/09/21/webkitgtk2.10.0-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/10/14/webkitgtk2.10.1-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/10/15/webkitgtk2.10.2-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/10/26/webkitgtk2.10.3-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/11/11/webkitgtk2.10.4-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/01/20/webkitgtk2.10.5-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/01/27/webkitgtk2.10.6-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/01/29/webkitgtk2.10.7-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/03/11/webkitgtk2.10.8-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/03/17/webkitgtk2.10.9-released.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3754","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3754","description":"The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.","status":"published","published":"2015-08-16T23:00:00Z","modified":"2024-08-06T05:56:15.229Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3790","description":"The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.","status":"published","published":"2015-08-16T23:00:00Z","modified":"2024-08-06T05:56:15Z","updated_at":"2026-11-03T02:22:06.756432Z"}],"ghsa":[{"id":"GHSA-vcw5-5m6w-mgw3","title":"The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and...","description":"The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.","status":"published","published":"2022-05-14T01:35:47Z","modified":"2023-02-02T05:04:07Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:51:47.403205Z"}],"nvd":[{"id":"CVE-2015-3754","description":"The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.","status":"published","published":"2015-08-16T23:59:27.533Z","modified":"2026-06-17T00:26:14.03Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:08.998581Z"}],"osv":[{"id":"MGASA-2016-0116","title":"Updated webkit2 packages fix security vulnerability","description":"The webkit2 package has been updated to version 2.10.9, fixing several\nsecurity issues and other bugs.\n","status":"published","published":"2016-03-25T06:38:37Z","modified":"2026-04-16T06:25:01.050514131Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-3754","description":"The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.","status":"published","published":"2015-08-16T23:59:00Z","modified":"2026-10-08T12:49:09.016468845Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}