CVE-2016-1849

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory.

Metrics

CVSS 3.0 3.3/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2016/May/msg00002.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2016/May/msg00005.htmlVendor Advisory
http://www.securitytracker.com/id/1035888
https://support.apple.com/HT206565Vendor Advisory
https://support.apple.com/HT206568Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/May/msg00002.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2016/May/msg00005.htmlVendor Advisory
http://www.securitytracker.com/id/1035888
https://support.apple.com/HT206565Vendor Advisory
https://support.apple.com/HT206568Vendor Advisory

Timeline

Published: May 20, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-18507.8SceneKit in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via CVE-2016-18514.6The Screen Lock feature in Apple OS X before 10.11.5 mishandles password profiles, which allows physically proximate attackers to reset expi CVE-2016-18522.4Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate atta CVE-2016-18537.5Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support.CVE-2016-18548.8WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or CVE-2016-18558.8WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or CVE-2016-18568.8WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or CVE-2016-18578.8WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or CVE-2016-18586.5WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, improperly tracks taint attributes, which allows remo CVE-2016-18598.8The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute ar CVE-2016-18603.3Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, CVE-2016-18617.8The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cau