{"id":"CVE-2015-8079","aliases":["EUVD-2015-7972","GHSA-wwwx-88mv-pg56","SUSE-SU-2016:2397-1","UBUNTU-CVE-2015-8079"],"status":"published","title":"qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.","description":"qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01374,"percentile":0.72192,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2016-09-27T13:11:45Z","modified":"2026-10-08T12:49:37Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"at","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-7.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"bogofilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kdelibs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.0-7.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libQtWebKit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6+2.3.3-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libbonobo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.1-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"netpbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.66.3-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.37-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libQtWebKit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6+2.3.3-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libbonobo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.1-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"mdbtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"netpbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.66.3-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"sgmltool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-1075.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"at","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-7.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.18-40.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.37-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kdelibs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.0-7.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libQtWebKit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6+2.3.3-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libbonobo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.1-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"netpbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.66.3-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"at","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-7.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"cyrus-imapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.18-40.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"flex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.37-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kdelibs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.0-7.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libQtWebKit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6+2.3.3-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libbonobo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.1-16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"netpbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.66.3-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openslp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"bogofilter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-1ubuntu2.1","5.5.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu10","2.3.2-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]}],"products":[{"vendor":"qt","product":"qtwebkit"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204795","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking"]},{"url":"http://www.openwall.com/lists/oss-security/2015/11/05/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","report"]},{"url":"https://codereview.qt-project.org/#/c/108936/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8079"},{"url":"https://codereview.qt-project.org/#/c/108936"},{"url":"https://github.com/advisories/GHSA-wwwx-88mv-pg56"},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162397-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/954210","tags":["report"]},{"url":"https://bugzilla.suse.com/990856","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6354","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8079","tags":["report"]},{"url":"http://sources.debian.net/src/qt4-x11/4:4.8.7%2Bdfsg-3/src/3rdparty/webkit/Source/WebCore/loader/FrameLoader.cpp/?hl=799#L799","tags":["report"]},{"url":"http://trac.webkit.org/changeset/181565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8079","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8079","description":"qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.","status":"published","published":"2017-09-07T20:00:00Z","modified":"2024-08-06T08:06:31.785Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-7972","description":"qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.","status":"published","published":"2017-09-07T20:00:00Z","modified":"2024-08-06T08:06:31Z","updated_at":"2026-11-03T01:57:28.296316Z"}],"ghsa":[{"id":"GHSA-wwwx-88mv-pg56","title":"qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.","description":"qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.","status":"published","published":"2022-05-13T01:06:56Z","modified":"2025-04-20T03:45:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:01:52.186588Z"}],"nvd":[{"id":"CVE-2015-8079","description":"qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.","status":"published","published":"2017-09-07T20:29:00.8Z","modified":"2026-06-17T00:34:00.353Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:19.244941Z"}],"osv":[{"id":"UBUNTU-CVE-2015-8079","description":"qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.","status":"published","published":"2017-09-07T20:29:00Z","modified":"2026-10-08T12:49:37.472216496Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"SUSE-SU-2016:2397-1","title":"Security update for flex, at, bogofilter, cyrus-imapd, kdelibs4, libQtWebKit4, libbonobo, mdbtools, netpbm, openslp, sgmltool, virtuoso, libqt5-qtwebkit","description":"\nVarious packages included vulnerable parsers generated by 'flex'.\n\nThis update provides a fixed 'flex' package and also rebuilds of packages\nthat might have security issues caused by the auto generated code.\n\nFlex itself was updated to fix a buffer overflow in the generated scanner\n(bsc#990856, CVE-2016-6354)\n\nPackages that were rebuilt with the fixed flex:\n- at\n- bogofilter\n- cyrus-imapd\n- kdelibs4\n- libQtWebKit4\n- libbonobo\n- mdbtools\n- netpbm\n- openslp\n- sgmltool\n- virtuoso\n\nAlso libqt5-qtwebkit received an additional security fix:\n- CVE-2015-8079: QtWebKit logs visited URLs to WebpageIcons.db in private browsing mode (bsc#954210).\n","status":"published","published":"2016-09-27T13:11:45Z","modified":"2026-02-04T03:35:34.237001Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}