CVE-2016-4760 — Improper Access Control in Apple Iphone OS

CWE-284 — Improper Access Control8 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.8%
top 25.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple Iphone OSApple ItunesApple Safari
Timeline
PublishedSep 25
Latest updateMay 17

Description

WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 support.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDapple/safari9.1.3
▶NVDapple/itunes12.4.3
▶NVDapple/iphone_os9.3.5

🔴Vulnerability Details

3
GHSA
GHSA-pqhh-972q-qrfv: WebKit in Apple iOS before 10, iTunes before 12↗2022-05-17
▶
CVEList
CVE-2016-4760: WebKit in Apple iOS before 10, iTunes before 12↗2016-09-25
▶
OSV
CVE-2016-4760: WebKit in Apple iOS before 10, iTunes before 12↗2016-09-25
▶

📋Vendor Advisories

4
Ubuntu
WebKitGTK+ vulnerabilities↗2017-01-10
▶
Apple
CVE-2016-4760: Safari 10↗2016-09-20
▶
Apple
CVE-2016-4760: iOS 10↗2016-09-13
▶
Apple
CVE-2016-4760: iTunes 12.5.1 for Windows↗2016-09-13
▶
CVE-2016-4760 — Improper Access Control in Apple | cvebase