CVE-2016-4590
published 2016-07-22CVE-2016-4590: WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted…
PriorityP425medium5.4CVSS 3.0
AVNACLPRNUIRSUCLILAN
EPSS
0.59%
69.7th percentile
WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | safari | <= 9.1.1 | — |
| apple | safari | — | — |
| debian | webkit2gtk | < webkit2gtk 2.12.4-1 (bookworm) | webkit2gtk 2.12.4-1 (bookworm) |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.4MEDIUM
vendor_debian5.4LOW
Ubuntu
WebKitGTK+ vulnerabilities
vendor_ubuntu·2016-09-14
CVE-2016-1854 WebKitGTK+ vulnerabilities
Title: WebKitGTK+ vulnerabilities
Summary: Several security issues were fixed in WebKitGTK+.
A large number of security issues were discovered in the WebKitGTK+ Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
Apple
CVE-2016-4590: iOS 9.3.3
vendor_apple·2016-07-18·CVSS 5.4
CVE-2016-4590 [MEDIUM] CVE-2016-4590: iOS 9.3.3
Apple Security Update: About the security content of iOS 9.3.3
Product: iOS
Version: 9.3.3
CVE: CVE-2016-4590
Component: WebKit
Impact: Visiting a malicious website may lead to user interface spoofing
Description: An origin inheritance issue existed in parsing of about: URLs. This was addressed through improved validation of security origins.
Apple
CVE-2016-4590: Safari 9.1.2
vendor_apple·2016-07-18·CVSS 5.4
CVE-2016-4590 [MEDIUM] CVE-2016-4590: Safari 9.1.2
Apple Security Update: About the security content of Safari 9.1.2
Product: Safari
Version: 9.1.2
CVE: CVE-2016-4590
Component: WebKit
Impact: Visiting a malicious website may lead to user interface spoofing
Description: An origin inheritance issue existed in parsing of about: URLs. This was addressed through improved validation of security origins.
Debian
CVE-2016-4590: webkit2gtk - WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs,...
vendor_debian·2016·CVSS 5.4
CVE-2016-4590 [MEDIUM] CVE-2016-4590: webkit2gtk - WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs,...
WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Scope: local
bookworm: resolved (fixed in 2.12.4-1)
bullseye: resolved (fixed in 2.12.4-1)
forky: resolved (fixed in 2.12.4-1)
sid: resolved (fixed in 2.12.4-1)
trixie: resolved (fixed in 2.12.4-1)
GHSA
GHSA-x7h9-4jcm-r6qh: WebKit in Apple iOS before 9
ghsa_unreviewed·2022-05-14
CVE-2016-4590 [MEDIUM] CWE-20 GHSA-x7h9-4jcm-r6qh: WebKit in Apple iOS before 9
WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
OSV
CVE-2016-4590: WebKit in Apple iOS before 9
osv·2016-07-22·CVSS 5.4
CVE-2016-4590 [MEDIUM] CVE-2016-4590: WebKit in Apple iOS before 9
WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2016/Jul/msg00004.htmlhttp://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.htmlhttp://www.securityfocus.com/archive/1/539295/100/0/threadedhttp://www.securityfocus.com/bid/91835http://www.securitytracker.com/id/1036343https://support.apple.com/HT206900https://support.apple.com/HT206902http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2016/Jul/msg00004.htmlhttp://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.htmlhttp://www.securityfocus.com/archive/1/539295/100/0/threadedhttp://www.securityfocus.com/bid/91835http://www.securitytracker.com/id/1036343https://support.apple.com/HT206900https://support.apple.com/HT206902
2016-07-22
Published