CVE-2015-2330
HighSummary
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
Risk Assessment
Organizations may be exposed to the disclosure of sensitive information, such as session cookies, which could lead to further attacks on users.
Recommendation
It is recommended to update WebKitGTK+ to version 2.6.6 or later to mitigate this issue.
Other vulnerabilities in WebKitGTK+
See all- CVE-2026-78376High
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
- CVE-2025-66287High
A flaw was found in WebKitGTK due to improper memory handling. Processing malicious web content can cause an unexpected process crash.
- CVE-2025-13947High
A vulnerability was found in WebKitGTK that allows remote, user-assisted information disclosure. The flaw is due to missing verification of the source of file drag-and-drop operations, enabling an attacker to read any file the user is permitted to access.
- CVE-2025-13502High
A flaw in WebKitGTK and WPE WebKit allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
Original NVD description (English source)
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.