CVE-2016-4590

Published: Jul 22, 2016Modified: May 6, 2026

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

Affected (2)

Products: Apple: Safari, Webkit

Apple

2 products

Safari

Webkit

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Apple Safari	Up to 9.1.1
Apple Webkit	All versions

Running on/with	Platform Versions
Apple Iphone Os	Up to 9.3.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (16)

http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html

Source: product-security@apple.com

Mailing List

http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html

Source: product-security@apple.com

Mailing List

http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html

Source: product-security@apple.com

http://www.securityfocus.com/archive/1/539295/100/0/threaded

Source: product-security@apple.com

http://www.securityfocus.com/bid/91835

Source: product-security@apple.com

http://www.securitytracker.com/id/1036343

Source: product-security@apple.com

https://support.apple.com/HT206900

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/HT206902

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html