Vulnerability Description
WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Itunes | <= 12.4.3 |
| Microsoft | Windows | All versions |
| Apple | Safari | <= 9.1.3 |
| Apple | Iphone Os | <= 9.3.5 |
Related Weaknesses (CWE)
References
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.htmlMailing ListVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.htmlMailing ListVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.htmlMailing ListVendor Advisory
- http://www.securityfocus.com/bid/93066
- http://www.securitytracker.com/id/1036854
- https://support.apple.com/HT207143Vendor Advisory
- https://support.apple.com/HT207157Vendor Advisory
- https://support.apple.com/HT207158Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.htmlMailing ListVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.htmlMailing ListVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.htmlMailing ListVendor Advisory
- http://www.securityfocus.com/bid/93066
- http://www.securitytracker.com/id/1036854
- https://support.apple.com/HT207143Vendor Advisory
- https://support.apple.com/HT207157Vendor Advisory
FAQ
What is CVE-2016-4763?
CVE-2016-4763 is a vulnerability with a CVSS score of 6.8 (MEDIUM). WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attacke...
How severe is CVE-2016-4763?
CVE-2016-4763 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-4763?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Itunes, Microsoft Windows, Apple Safari, Apple Iphone Os.