CVE-2016-4758

Published: Sep 25, 2016Modified: May 6, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.

Affected (3)

Products: Apple: Iphone Os, Safari, Itunes

3 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Up to 9.3.5
Apple Safari	Up to 9.1.3

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Apple Itunes	Up to 12.4.3

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (18)

http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html

Source: product-security@apple.com

Mailing ListVendor Advisory

http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html

Source: product-security@apple.com

Mailing ListVendor Advisory

http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html

Source: product-security@apple.com

Mailing ListVendor Advisory

http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html

Source: product-security@apple.com

http://www.securityfocus.com/bid/93066

Source: product-security@apple.com

http://www.securitytracker.com/id/1036854

Source: product-security@apple.com

https://support.apple.com/HT207143

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/HT207157

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/HT207158

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html