{"id":"CVE-2015-5825","aliases":["EUVD-2015-5771","GHSA-hv69-h9mv-592v","MGASA-2016-0116","UBUNTU-CVE-2015-5825"],"status":"published","title":"WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times...","description":"WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02022,"percentile":0.81106,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2015-09-18T10:00:00Z","modified":"2026-10-08T12:49:31Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"webkit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.9-1.mga5"}]}],"bundled":106},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-1ubuntu2.1","5.5.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu10","2.3.2-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]}],"products":[{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"safari"}],"references":[{"url":"http://www.securitytracker.com/id/1033609","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://support.apple.com/HT205212","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://www.securityfocus.com/bid/76766","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://support.apple.com/HT205265","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00007.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5825"},{"url":"https://github.com/advisories/GHSA-hv69-h9mv-592v"},{"url":"https://advisories.mageia.org/MGASA-2016-0116.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17662","tags":["report"]},{"url":"http://webkitgtk.org/security/WSA-2015-0002.html","tags":["web"]},{"url":"http://webkitgtk.org/security/WSA-2016-0001.html","tags":["web"]},{"url":"http://webkitgtk.org/security/WSA-2016-0002.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/04/14/webkitgtk2.8.1-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/05/12/webkitgtk2.8.2-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/07/08/webkitgtk2.8.4-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/08/06/webkitgtk2.8.5-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/09/21/webkitgtk2.10.0-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/10/14/webkitgtk2.10.1-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/10/15/webkitgtk2.10.2-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/10/26/webkitgtk2.10.3-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2015/11/11/webkitgtk2.10.4-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/01/20/webkitgtk2.10.5-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/01/27/webkitgtk2.10.6-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/01/29/webkitgtk2.10.7-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/03/11/webkitgtk2.10.8-released.html","tags":["web"]},{"url":"http://www.webkitgtk.org/2016/03/17/webkitgtk2.10.9-released.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5825","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5825","description":"WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.","status":"published","published":"2015-09-18T10:00:00Z","modified":"2024-08-06T06:59:04.433Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-5771","description":"WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.","status":"published","published":"2015-09-18T10:00:00Z","modified":"2024-08-06T06:59:04Z","updated_at":"2026-11-03T02:21:58.196951Z"}],"ghsa":[{"id":"GHSA-hv69-h9mv-592v","title":"WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times...","description":"WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.","status":"published","published":"2022-05-17T03:19:13Z","modified":"2023-01-27T05:07:56Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:43:12.891051Z"}],"nvd":[{"id":"CVE-2015-5825","description":"WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.","status":"published","published":"2015-09-18T10:59:44.377Z","modified":"2026-06-17T00:29:51.007Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:09.92183Z"}],"osv":[{"id":"MGASA-2016-0116","title":"Updated webkit2 packages fix security vulnerability","description":"The webkit2 package has been updated to version 2.10.9, fixing several\nsecurity issues and other bugs.\n","status":"published","published":"2016-03-25T06:38:37Z","modified":"2026-04-16T06:25:01.050514131Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-5825","description":"WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.","status":"published","published":"2015-09-18T10:59:00Z","modified":"2026-10-08T12:49:31.974212826Z","updated_at":"2026-11-02T15:54:10.385269Z"}]}}