CVE-2016-4651 — Cross-site Scripting in Apple Iphone OS

Vendor	Product	Version range	Fixed in
apple	ios	—	—
apple	iphone_os	<= 9.3.2	—
apple	safari	<= 9.1.1	—
apple	safari	—	—

Ubuntu

WebKitGTK+ vulnerabilities

vendor_ubuntu·2016-09-14

CVE-2016-1854 WebKitGTK+ vulnerabilities Title: WebKitGTK+ vulnerabilities Summary: Several security issues were fixed in WebKitGTK+. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Instructions: This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use WebKitGTK+, such as Epiphany, to make all the necessary changes.

Apple

CVE-2016-4651: iOS 9.3.3

vendor_apple·2016-07-18·CVSS 6.1

CVE-2016-4651 [MEDIUM] CVE-2016-4651: iOS 9.3.3 Apple Security Update: About the security content of iOS 9.3.3 Product: iOS Version: 9.3.3 CVE: CVE-2016-4651 Component: WebKit JavaScript Bindings Impact: Visiting a maliciously crafted website may lead to script execution in the context of a non-HTTP service Description: A cross-protocol cross-site scripting (XPXSS) issue existed in Safari when submitting forms to non-HTTP services compatible with HTTP/0.9. This issue was addressed by disabling scripts and plugins on resources loaded over HTTP/0.9.

Apple

CVE-2016-4651: Safari 9.1.2

vendor_apple·2016-07-18·CVSS 6.1

CVE-2016-4651 [MEDIUM] CVE-2016-4651: Safari 9.1.2 Apple Security Update: About the security content of Safari 9.1.2 Product: Safari Version: 9.1.2 CVE: CVE-2016-4651 Component: WebKit JavaScript Bindings Impact: Visiting a maliciously crafted website may lead to script execution in the context of a non-HTTP service Description: A cross-protocol cross-site scripting (XPXSS) issue existed in Safari when submitting forms to non-HTTP services compatible with HTTP/0.9. This issue was addressed by disabling scripts and plugins on resources loaded over HTTP/0.9.

GHSA

GHSA-377q-pqm6-wg2h: Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9

ghsa_unreviewed·2022-05-14

CVE-2016-4651 [MEDIUM] CWE-79 GHSA-377q-pqm6-wg2h: Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9 Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability.

OSV

CVE-2016-4651: Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9

osv·2016-07-21·CVSS 6.1

CVE-2016-4651 [MEDIUM] CVE-2016-4651: Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9 Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability.

CVE-2016-4651: Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject…

Affected

CVSS provenance