CVE-2016-1859 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Iphone OS

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer9 documents6 sources
Severity
8.8HIGHNVD
EPSS
0.8%
top 25.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple Iphone OSApple SafariApple Tvos+2 more
Timeline
PublishedMay 20
Latest updateMay 14

Description

The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶NVDapple/tvos< 9.2.1
▶NVDapple/safari< 9.1.1
▶Appleapple/tvos9.2.1
▶Appleapple/safari9.1.1
▶NVDapple/iphone_os< 9.3.2

🔴Vulnerability Details

2
GHSA
GHSA-38xg-gj4r-c6w4: The WebKit Canvas implementation in Apple iOS before 9↗2022-05-14
▶
OSV
CVE-2016-1859: The WebKit Canvas implementation in Apple iOS before 9↗2016-05-20
▶

📋Vendor Advisories

4
Ubuntu
WebKitGTK+ vulnerabilities↗2016-09-14
▶
Apple
CVE-2016-1859: iOS 9.3.2↗
▶
Apple
CVE-2016-1859: tvOS 9.2.1↗
▶
Apple
CVE-2016-1859: Safari 9.1.1↗
▶

📄Research Papers

2
arXiv
SOK: On the Analysis of Web Browser Security↗2021-12-31
▶
arXiv
Rethinking Misalignment to Raise the Bar for Heap Pointer Corruption↗2018-08-08
▶