CVE-2016-4719

Published: Sep 18, 2016Modified: May 6, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The GeoServices component in Apple iOS before 10 and watchOS before 3 does not properly restrict access to PlaceData information, which allows attackers to discover physical locations via a crafted application.

Affected (2)

Products: Apple: Watchos, Iphone Os

Apple

2 products

Watchos

Iphone Os

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Watchos	Up to 2.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Up to 9.3.5

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (16)

http://lists.apple.com/archives/security-announce/2016/Sep/msg00004.html

Source: product-security@apple.com

Mailing ListVendor Advisory

http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html

Source: product-security@apple.com

http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html

Source: product-security@apple.com

http://www.securityfocus.com/bid/92932

Source: product-security@apple.com

http://www.securityfocus.com/bid/92933

Source: product-security@apple.com

http://www.securitytracker.com/id/1036797

Source: product-security@apple.com

https://support.apple.com/HT207141

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/HT207143

Source: product-security@apple.com

http://lists.apple.com/archives/security-announce/2016/Sep/msg00004.html