CVE-2016-1728 — Sensitive Information Exposure in Apple Iphone OS

CWE-200 — Sensitive Information Exposure5 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.8%
top 26.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple Iphone OSApple SafariApple IOS
Timeline
PublishedFeb 1
Latest updateMay 14

Description

The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height processing, which makes it easier for remote attackers to obtain sensitive browser-history information via a crafted web site.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDapple/safari9.0.2
▶Appleapple/safari9.0.3
▶Appleapple/ios9.2.1

🔴Vulnerability Details

2
GHSA
GHSA-pfv7-c6xr-gq92: The Cascading Style Sheets (CSS) implementation in Apple iOS before 9↗2022-05-14
▶
OSV
CVE-2016-1728: The Cascading Style Sheets (CSS) implementation in Apple iOS before 9↗2016-02-01
▶

📋Vendor Advisories

2
Apple
CVE-2016-1728: Safari 9.0.3↗
▶
Apple
CVE-2016-1728: iOS 9.2.1↗
▶
CVE-2016-1728 — Sensitive Information Exposure in Apple | cvebase