Vulnerability Description
WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Safari | <= 9.1.3 |
| Apple | Iphone Os | <= 9.3.5 |
| Apple | Itunes | <= 12.4.3 |
| Microsoft | Windows | All versions |
Related Weaknesses (CWE)
References
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.htmlMailing ListVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.htmlMailing ListVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.htmlMailing ListVendor Advisory
- http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html
- http://www.securityfocus.com/bid/93066
- http://www.securitytracker.com/id/1036854
- https://support.apple.com/HT207143Vendor Advisory
- https://support.apple.com/HT207157Vendor Advisory
- https://support.apple.com/HT207158Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.htmlMailing ListVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.htmlMailing ListVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.htmlMailing ListVendor Advisory
- http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html
- http://www.securityfocus.com/bid/93066
- http://www.securitytracker.com/id/1036854
FAQ
What is CVE-2016-4758?
CVE-2016-4758 is a vulnerability with a CVSS score of 6.5 (MEDIUM). WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive infor...
How severe is CVE-2016-4758?
CVE-2016-4758 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-4758?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Safari, Apple Iphone Os, Apple Itunes, Microsoft Windows.