CVE-2016-4585: XSS
First published: Fri Jul 22 2016(Updated: )
Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple WebKit | ||
| Apple Mobile Safari | <9.1.2 | |
| iStyle @cosme iPhone OS | <9.3.3 | |
| tvOS | <9.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html
- http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html
- http://www.securityfocus.com/archive/1/539295/100/0/threaded
- http://www.securityfocus.com/bid/91830
- http://www.securitytracker.com/id/1036343
- https://support.apple.com/HT206900
- https://support.apple.com/HT206902
- https://support.apple.com/HT206905
Frequently Asked Questions
What is the severity of CVE-2016-4585?
CVE-2016-4585 is considered a moderate severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2016-4585?
To fix CVE-2016-4585, update your Apple iOS, Safari, or tvOS to the latest version available.
What versions are affected by CVE-2016-4585?
CVE-2016-4585 affects Apple iOS versions before 9.3.3, Safari versions before 9.1.2, and tvOS versions before 9.2.2.
Can CVE-2016-4585 be exploited remotely?
Yes, CVE-2016-4585 can be exploited remotely allowing attackers to inject arbitrary web script or HTML.
What component of Apple software does CVE-2016-4585 affect?
CVE-2016-4585 affects the WebKit Page Loading implementation used in Apple software.
- agent/references
- agent/type
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/apple webkit
- canonical/apple mobile safari
- canonical/istyle @cosme iphone os
- canonical/tvos