High severity · published Jul 22, 2016
CVE-2016-4591
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via…
7.5
CVSS
4.3%
EPSS
No
On KEV
Description
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webkit · Apple
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4591
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4591
Mailing List
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
Mailing List
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
Mailing List
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html
Third Party Advisory
http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html
Third Party Advisory
http://www.securityfocus.com/archive/1/539295/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/91830
More from Webkit
8.8
CVE-2017-7160
An issue was discovered in certain Apple products
8.8
CVE-2017-7157
An issue was discovered in certain Apple products
8.8
CVE-2017-7156
An issue was discovered in certain Apple products
8.8
CVE-2017-13870
An issue was discovered in certain Apple products
8.8
CVE-2017-13866
An issue was discovered in certain Apple products