7.8

CVE-2016-4591

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ WebKit
   Apple ≫ Safari Version < 9.1.2
   Apple ≫ iPhone OS Version < 9.3.3
   Apple ≫ tvOS Version < 9.2.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.22% 0.897
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:C/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
Vendor Advisory
Mailing List
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
Vendor Advisory
Mailing List
https://support.apple.com/HT206902
Vendor Advisory
https://support.apple.com/HT206905
Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html
Vendor Advisory
Mailing List
http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/539295/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/91830
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036343
Third Party Advisory
VDB Entry
https://support.apple.com/HT206900
Vendor Advisory