CVE-2016-4763 — Apple Iphone OS vulnerability

CWE-3107 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
0.2%
top 61.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple Iphone OSApple ItunesApple Safari
Timeline
PublishedSep 25
Latest updateMay 17

Description

WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 1.6 | Impact: 5.2

Affected Packages3 packages

▶NVDapple/itunes12.4.3
▶NVDapple/safari9.1.3
▶NVDapple/iphone_os9.3.5

🔴Vulnerability Details

3
GHSA
GHSA-89gg-jvv4-j8gq: WKWebView in WebKit in Apple iOS before 10, iTunes before 12↗2022-05-17
▶
CVEList
CVE-2016-4763: WKWebView in WebKit in Apple iOS before 10, iTunes before 12↗2016-09-25
▶
OSV
CVE-2016-4763: WKWebView in WebKit in Apple iOS before 10, iTunes before 12↗2016-09-25
▶

📋Vendor Advisories

3
Apple
CVE-2016-4763: Safari 10↗2016-09-20
▶
Apple
CVE-2016-4763: iOS 10↗2016-09-13
▶
Apple
CVE-2016-4763: iTunes 12.5.1 for Windows↗2016-09-13
▶
CVE-2016-4763 — Apple Iphone OS vulnerability | cvebase