CVE-2016-4591

Опубликовано: 22 июл. 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 7.8

EPSS Низкий

Описание

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.

Ссылки

http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
Mailing List
Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
Mailing List
Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html
Mailing List
Vendor Advisory
http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/539295/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/91830
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036343
Third Party Advisory
VDB Entry
https://support.apple.com/HT206900
Vendor Advisory
https://support.apple.com/HT206902
Vendor Advisory
https://support.apple.com/HT206905
Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
Mailing List
Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
Mailing List
Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html
Mailing List
Vendor Advisory
http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/539295/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/91830
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036343
Third Party Advisory
VDB Entry
https://support.apple.com/HT206900
Vendor Advisory
https://support.apple.com/HT206902
Vendor Advisory
https://support.apple.com/HT206905
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:apple:webkit:*:*:*:*:*:*:*:*

Одно из

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Версия до 9.1.2 (исключая)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия до 9.3.3 (исключая)

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*

Версия до 9.2.2 (исключая)

EPSS

Процентиль: 91%

0.04256

Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-284

Связанные уязвимости

CVE-2016-4591

CVSS3: 7.5

ubuntu

больше 10 лет назад

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.

CVE-2016-4591

CVSS3: 7.5

debian

больше 10 лет назад

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before ...

GHSA-528c-rrj8-7mch

CVSS3: 7.5

github

больше 4 лет назад

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.

ALT-PU-2016-1890

CVSS3: 8.8

altlinux

около 10 лет назад

ALT-PU-2016-1890: package `libwebkitgtk4` update to version 2.12.4-alt1

EPSS

Процентиль: 91%

0.04256

Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-284