CVE-2015-5825

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Sep 18, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-58264.3WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the texCVE-2015-58275.0WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving aCVE-2015-58284.3The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status codeCVE-2015-58296.8Data Detectors Engine in Apple iOS before 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruptioCVE-2015-58307.2The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory coCVE-2015-58315.0NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows attackers to oCVE-2015-58322.1The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action, whichCVE-2015-58337.2The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, which allows physicallCVE-2015-58344.3IOAcceleratorFamily in Apple iOS before 9 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.CVE-2015-58354.3Apple iOS before 9 allows attackers to obtain sensitive information about inter-app communication via a crafted app that conducts an interceCVE-2015-58364.3Apple Online Store Kit in Apple OS X before 10.11 improperly validates iCloud keychain item ACLs, which allows attackers to obtain access toCVE-2015-58374.3PluginKit in Apple iOS before 9 allows attackers to bypass an intended app-trust requirement and install arbitrary extensions via a crafted
CVE-2015-5825: Medium severity, CVSS 4.3 | Vulnix