CVE-2016-1781

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-19

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.htmlVendor Advisory
http://www.securityfocus.com/archive/1/537948/100/0/threaded
http://www.securitytracker.com/id/1035353
https://support.apple.com/HT205635Vendor Advisory
https://support.apple.com/HT205639Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.htmlVendor Advisory
http://www.securityfocus.com/archive/1/537948/100/0/threaded
http://www.securitytracker.com/id/1035353
https://support.apple.com/HT205635Vendor Advisory
https://support.apple.com/HT205639Vendor Advisory

Timeline

Published: Mar 24, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-17826.5WebKit in Apple iOS before 9.3 and Safari before 9.1 does not properly restrict redirects that specify a TCP port number, which allows remot CVE-2016-17838.8WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to execute arbitrary code or cause a denial o CVE-2016-17846.5The History implementation in WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to cause a deni CVE-2016-17856.5The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cache CVE-2016-17865.4The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirectio CVE-2016-17875.3Wiki Server in Apple OS X Server before 5.1 allows remote attackers to obtain sensitive information from Wiki pages via unspecified vectors.CVE-2016-17885.9Messages in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 does not properly implement a cryptographic protection mechani CVE-2016-17895.5Apple iBooks Author before 2.4.1 allows remote attackers to read arbitrary files via an iBooks Author file containing an XML external entity CVE-2016-17903.3Buffer overflow in the Accessibility component in Apple iOS before 9.3.2 allows attackers to obtain sensitive kernel memory-layout informati CVE-2016-17913.3The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.CVE-2016-17927.8The AMD subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of servi CVE-2016-17937.8AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a