CVE-2016-4585 — Cross-site Scripting in Apple IOS

CWE-79 — Cross-site Scripting7 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
1.0%
top 22.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple IOSApple SafariApple Tvos
Timeline
PublishedJul 22
Latest updateMay 14

Description

Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶Appleapple/safari9.1.2
▶Appleapple/tvos9.2.2
▶Appleapple/ios9.3.3

🔴Vulnerability Details

2
GHSA
GHSA-qw3f-692v-r8m2: Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9↗2022-05-14
▶
OSV
CVE-2016-4585: Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9↗2016-07-21
▶

📋Vendor Advisories

4
Ubuntu
WebKitGTK+ vulnerabilities↗2016-09-14
▶
Apple
CVE-2016-4585: iOS 9.3.3↗2016-07-18
▶
Apple
CVE-2016-4585: tvOS 9.2.2↗2016-07-18
▶
Apple
CVE-2016-4585: Safari 9.1.2↗2016-07-18
▶