CVE-2016-4585

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.htmlMailing List, Vendor Advisory
http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539295/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91830Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036343Third Party Advisory, VDB Entry
https://support.apple.com/HT206900Vendor Advisory
https://support.apple.com/HT206902Vendor Advisory
https://support.apple.com/HT206905Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.htmlMailing List, Vendor Advisory
http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539295/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91830Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036343Third Party Advisory, VDB Entry
https://support.apple.com/HT206900Vendor Advisory
https://support.apple.com/HT206902Vendor Advisory
https://support.apple.com/HT206905Vendor Advisory

Timeline

Published: Jul 22, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-45868.8WebKit in Apple Safari before 9.1.2 and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (me CVE-2016-45876.5WebKit in Apple iOS before 9.3.3 and tvOS before 9.2.2 allows remote attackers to obtain sensitive information from uninitialized process me CVE-2016-45888.8WebKit in Apple tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a c CVE-2016-45898.8WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a de CVE-2016-45905.4WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Pol CVE-2016-45917.5WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers CVE-2016-45926.5WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory co CVE-2016-45932.4The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via u CVE-2016-45947.8The Sandbox Profiles component in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows attackers CVE-2016-45954.6Safari Login AutoFill in Apple OS X before 10.11.6 allows physically proximate attackers to discover passwords by reading the screen during CVE-2016-45968.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi CVE-2016-45978.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi