CVE-2016-4758

MEDIUM

Apple Safari < 9.1.3 - Information Disclosure

Title source: rule

Description

WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.

References (9)

[Mailing List, Vendor Advisory] http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html

[Mailing List, Vendor Advisory] http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html

[Mailing List, Vendor Advisory] http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html

[Various Sources] http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1036854

[Vendor Advisory] https://support.apple.com/HT207143

[Vendor Advisory] https://support.apple.com/HT207157

[Vendor Advisory] https://support.apple.com/HT207158

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/93066

Scores

CVSS v3 6.5

EPSS 0.0092

EPSS Percentile 75.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (4)

apple/safari < 9.1.3

apple/iphone_os < 9.3.5

apple/itunes < 12.4.3

n/a/n/a

Timeline

Published Sep 25, 2016

Tracked Since Feb 18, 2026