CVE-2016-4585

MEDIUM

WebKit - Cross-Site Scripting via HTTP Redirect Mishandling

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.

References (10)

Core 10
Core References
Mailing List, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
Mailing List, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91830
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT206900
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036343
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/539295/100/0/threaded
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT206905
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT206902
Mailing List, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html

Scores

CVSS v3 6.1
EPSS 0.0192
EPSS Percentile 77.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
apple/webkit
Published Jul 22, 2016
Tracked Since Feb 18, 2026