Lucene search

AppleCVE-2016-4583

HistoryJul 22, 2016 - 2:59 a.m.

CVE-2016-4583

2016-07-2202:59:05

CWE-362

apple

web.nvd.nist.gov

cve-2016-4583

webkit

apple ios

safari

tvos

same origin policy

remote attack

timing attack

security vulnerability

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

Low

EPSS

0.003

Percentile

68.9%

JSON

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.

Affected configurations

Nvd

Node

applewebkitMatch-

AND

applesafariRange<9.1.2

appleiphone_osRange<9.3.3

appletvosRange<9.2.2

Node

webkitgtkwebkitgtk\+Range<2.12.2

VendorProductVersionCPE
applewebkit-cpe:2.3:a:apple:webkit:-:*:*:*:*:*:*:*
applesafari*cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
appletvos*cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
webkitgtkwebkitgtk\+*cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	webkit	-	cpe:2.3:a:apple:webkit:-:::::::*
apple	safari	*	cpe:2.3:a:apple:safari::::::::
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	tvos	*	cpe:2.3:o:apple:tvos::::::::
webkitgtk	webkitgtk\+	*	cpe:2.3:a:webkitgtk:webkitgtk\+::::::::

References

lists.apple.com/archives/security-announce/2016/Jul/msg00001.html

lists.apple.com/archives/security-announce/2016/Jul/msg00003.html

lists.apple.com/archives/security-announce/2016/Jul/msg00004.html

packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html

www.securityfocus.com/archive/1/539295/100/0/threaded

www.securityfocus.com/bid/91830

www.securitytracker.com/id/1036343

support.apple.com/HT206900

support.apple.com/HT206902

support.apple.com/HT206905

Social References

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

Low

EPSS

0.003

Percentile

68.9%

JSON

Related for CVE-2016-4583