CVE-2016-4591

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.htmlMailing List, Vendor Advisory
http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539295/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91830Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036343Third Party Advisory, VDB Entry
https://support.apple.com/HT206900Vendor Advisory
https://support.apple.com/HT206902Vendor Advisory
https://support.apple.com/HT206905Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.htmlMailing List, Vendor Advisory
http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539295/100/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91830Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036343Third Party Advisory, VDB Entry
https://support.apple.com/HT206900Vendor Advisory
https://support.apple.com/HT206902Vendor Advisory
https://support.apple.com/HT206905Vendor Advisory

Timeline

Published: Jul 22, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-45926.5WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory co CVE-2016-45932.4The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via u CVE-2016-45947.8The Sandbox Profiles component in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows attackers CVE-2016-45954.6Safari Login AutoFill in Apple OS X before 10.11.6 allows physically proximate attackers to discover passwords by reading the screen during CVE-2016-45968.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi CVE-2016-45978.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi CVE-2016-45989.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi CVE-2016-45997.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi CVE-2016-46008.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi CVE-2016-46018.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi CVE-2016-46028.8QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi CVE-2016-46034.3Web Media in Apple iOS before 9.3.3 allows attackers to bypass the Private Browsing protection mechanism and obtain sensitive video URL info