CVE-2016-1785: Infoleak
First published: Thu Mar 24 2016(Updated: )
The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Mobile Safari | <=9.0.3 | |
| iStyle @cosme iPhone OS | <=9.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html
- http://www.securityfocus.com/archive/1/537948/100/0/threaded
- http://www.securitytracker.com/id/1035353
- https://support.apple.com/HT206166
- https://support.apple.com/HT206171
Frequently Asked Questions
What is the severity of CVE-2016-1785?
CVE-2016-1785 is classified as a moderate severity vulnerability.
How do I fix CVE-2016-1785?
To fix CVE-2016-1785, users should update their Apple iOS and Safari to the latest versions.
What types of devices are affected by CVE-2016-1785?
CVE-2016-1785 affects Safari versions up to 9.0.3 and iOS versions up to 9.2.1.
What does CVE-2016-1785 exploit?
CVE-2016-1785 exploits a flaw in the Page Loading implementation that mishandles character encoding.
What could attackers achieve with CVE-2016-1785?
Attackers could bypass the Same Origin Policy and access sensitive information through crafted websites.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/apple mobile safari
- version/apple mobile safari/9.0.3
- canonical/istyle @cosme iphone os
- version/istyle @cosme iphone os/9.2.1