CVE-2016-4590
CVE-2016-4590
This page contains facts from public vulnerability sources. Check the original advisory before updating.
WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVSS 5.4 · Medium · EPSS 1.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
webkit2gtk Debian:12
- Affected ranges
- ECOSYSTEM: < 2.12.4-1
Update to 2.12.4-1
webkit2gtk Debian:13
- Affected ranges
- ECOSYSTEM: < 2.12.4-1
Update to 2.12.4-1
webkit2gtk Debian:14
- Affected ranges
- ECOSYSTEM: < 2.12.4-1
Update to 2.12.4-1
webkit2gtk Ubuntu:16.04:LTS
- Versions
- 2.8.5+dfsg1-3
- 2.10.3+dfsg1-1
- 2.10.4+dfsg1-1
- 2.10.5-1
- 2.10.6-1
- 2.10.6-1ubuntu1
- 2.10.8-1ubuntu1
- 2.10.9-1ubuntu1
- Affected ranges
- ECOSYSTEM: < 2.12.5-0ubuntu0.16.04.1
Update to 2.12.5-0ubuntu0.16.04.1
qtwebkit-opensource-src Ubuntu:16.04:LTS
- Versions
- 5.4.2+dfsg-1ubuntu2.1
- 5.5.1+dfsg-2ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtwebkit-source Ubuntu:16.04:LTS
- Versions
- 2.3.2-0ubuntu10
- 2.3.2-0ubuntu11
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
webkitgtk Ubuntu:16.04:LTS
- Versions
- 2.4.9-2ubuntu2
- 2.4.10-0ubuntu1
- 2.4.11-0ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
- http://www.securityfocus.com/bid/91835
- https://support.apple.com/HT206900
- http://www.securitytracker.com/id/1036343
- http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html
- http://www.securityfocus.com/archive/1/539295/100/0/threaded
- https://support.apple.com/HT206902
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-4590