var-201605-0424
Vulnerability from variot
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and CVE-2016-1857. Apple iOS , Safari and tvOS Used in etc. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of DataCue objects. By manipulating a document's elements an attacker can cause a DataCue object in memory to be reused after it has been freed. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Failed exploit attempts may result in a denial-of-service condition. Apple iOS is an operating system developed for mobile devices; watchOS is an operating system for smart watches. Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome.
Ubuntu Security Notice USN-3079-1 September 14, 2016
webkit2gtk vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in WebKitGTK+.
Software Description: - webkit2gtk: JavaScript engine library from WebKitGTK+ - GObject introspection
Details:
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04 LTS: libjavascriptcoregtk-4.0-18 2.12.5-0ubuntu0.16.04.1 libwebkit2gtk-4.0-37 2.12.5-0ubuntu0.16.04.1
This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-3079-1 CVE-2016-1854, CVE-2016-1856, CVE-2016-1857, CVE-2016-1858, CVE-2016-1859, CVE-2016-4583, CVE-2016-4585, CVE-2016-4586, CVE-2016-4588, CVE-2016-4589, CVE-2016-4590, CVE-2016-4591, CVE-2016-4622, CVE-2016-4623, CVE-2016-4624, CVE-2016-4651
Package Information: https://launchpad.net/ubuntu/+source/webkit2gtk/2.12.5-0ubuntu0.16.04.1
. ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2016-0004
Date reported : May 30, 2016 Advisory ID : WSA-2016-0004 Advisory URL : http://webkitgtk.org/security/WSA-2016-0004.html CVE identifiers : CVE-2016-1854, CVE-2016-1856, CVE-2016-1857, CVE-2016-1858, CVE-2016-1859.
Several vulnerabilities were discovered in WebKitGTK+.
CVE-2016-1854 Versions affected: WebKitGTK+ before 2.12.1.
CVE-2016-1856 Versions affected: WebKitGTK+ before 2.12.1.
CVE-2016-1857 Versions affected: WebKitGTK+ before 2.12.3.
CVE-2016-1858 Versions affected: WebKitGTK+ before 2.12.0. Credit to Anonymous.
CVE-2016-1859 Versions affected: WebKitGTK+ before 2.12.1.
We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases.
Further information about WebKitGTK+ Security Advisories can be found at: http://webkitgtk.org/security.html
The WebKitGTK+ team, May 30, 2016
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
APPLE-SA-2016-05-16-1 tvOS 9.2.1
tvOS 9.2.1 is now available and addresses the following:
CFNetwork Proxies Available for: Apple TV (4th generation) Impact: An attacker in a privileged network position may be able to leak sensitive user information Description: An information leak existed in the handling of HTTP and HTTPS requests. This issue was addressed through improved URL handling. CVE-ID CVE-2016-1801 : Alex Chapman and Paul Stone of Context Information Security
CommonCrypto Available for: Apple TV (4th generation) Impact: A malicious application may be able to leak sensitive user information Description: An issue existed in the handling of return values in CCCrypt. This issue was addressed through improved key length management. CVE-ID CVE-2016-1802 : Klaus Rodewig
CoreCapture Available for: Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1803 : Ian Beer of Google Project Zero, daybreaker working with Trend Micro’s Zero Day Initiative
Disk Images Available for: Apple TV (4th generation) Impact: An application may be able to read kernel memory Description: A race condition was addressed through improved locking. CVE-ID CVE-2016-1807 : Ian Beer of Google Project Zero
Disk Images Available for: Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the parsing of disk images. This issue was addressed through improved memory handling. CVE-ID CVE-2016-1808 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro
ImageIO Available for: Apple TV (4th generation) Impact: Processing a maliciously crafted image may lead to a denial of service Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1811 : Lander Brandt (@landaire)
IOAcceleratorFamily Available for: Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1817 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of Trend Micro working with Trend Micro's Zero Day Initiative CVE-2016-1818 : Juwei Lin of TrendMicro
IOAcceleratorFamily Available for: Apple TV (4th generation) Impact: An application may be able to cause a denial of service Description: A null pointer dereference was addressed through improved locking. CVE-ID CVE-2016-1819 : Ian Beer of Google Project Zero
IOAcceleratorFamily Available for: Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1813 : Ian Beer of Google Project Zero
IOHIDFamily Available for: Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1823 : Ian Beer of Google Project Zero CVE-2016-1824 : Marco Grassi (@marcograss) of KeenLab (@keen_lab), Tencent
Kernel Available for: Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1827 : Brandon Azad CVE-2016-1828 : Brandon Azad CVE-2016-1829 : CESG CVE-2016-1830 : Brandon Azad
libc Available for: Apple TV (4th generation) Impact: An application may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1832 : Karl Williamson
libxml2 Available for: Apple TV (4th generation) Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1833 : Mateusz Jurczyk CVE-2016-1834 : Apple CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological University CVE-2016-1837 : Wei Lei and Liu Yang of Nanyang Technological University CVE-2016-1838 : Mateusz Jurczyk CVE-2016-1839 : Mateusz Jurczyk CVE-2016-1840 : Kostya Serebryany
libxslt Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1847 : Tongbo Luo and Bo Qu of Palo Alto Networks
WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may disclose data from another website Description: An insufficient taint tracking issue in the parsing of svg images was addressed through improved taint tracking. CVE-ID CVE-2016-1854 : Anonymous working with Trend Micro's Zero Day Initiative CVE-2016-1855 : Tongbo Luo and Bo Qu of Palo Alto Networks CVE-2016-1856 : lokihardt working with Trend Micro's Zero Day Initiative CVE-2016-1857 : Jeonghoon Shin@A.D.D, Liang Chen, Zhen Feng, wushi of KeenLab, Tencent working with Trend Micro's Zero Day Initiative
WebKit Canvas Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1859 : Liang Chen, wushi of KeenLab, Tencent working with Trend Micro's Zero Day Initiative
Installation note:
Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software.".
To check the current version of software, select "Settings -> General -> About".
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJXOjzyAAoJEIOj74w0bLRGWI8P/jLFPTwi0qbBczPo3VUwDR07 ZPtJa1T0RXjshbBNgpNde8wiD9ZbYE9/ahrOPlmGupxrX6GKMGPPLtbD3msPlkCp BQbo/NgK0+uzkUNhzmS0cwsJNjRfbswIkV4iDBpxTvE+n0LheJqp416XSYlqimtx zrNq7Qm3koqdTHafOXMzuOUkD957p1ii9SHJZBGyF68XT2QmEgc+L3lg6QVJ9jwU HnQ4SuViEZ+qQKEqmo8ADXkzuJfiPsmeiTDWWCdgLhlM6ucTWxhOXbZP6mbmCBLa zc9jW9gjbxBAHOTJqjlqNrAtP01VGf5Vqel+jSOaAAXMrP8Dk4/e26qj6PL6iAu3 CbHusl8ItSPAUaTMP8K3WVUiseFDWENKMz2i4VS/nZvoaGtHeJefek3RIyaQw1sQ IcLqmbMmhUgY8voFHWz9RHMJX7wL6MuZWm2mHFvJ2XKxbQdeLD3d5yABRju9gldn /FcSkDmFXqVZKnfFpli877am1Z4jVXBgrWMGdEV3HENhV9WYTyGBZG8eZDTLiQqe pw8DZufpPZt0U/c2X+/qH5AQjcdStTfzv0xb3MqVh5GP3dZoQnP3nTlGRv2a7Vlf v0XdrgNCv2s7CLelv6WiXcEeeVP95XkwNTFf1+oZaZxwFZeY+iAkiR1Z7ItdWlFQ bdUbGfVTcdKWfjj6Jwr+ =CLh/ -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201605-0424",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "9.3.2"
},
{
"model": "safari",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "9.1.1"
},
{
"model": "webkitgtk\\+",
"scope": "lt",
"trust": 1.0,
"vendor": "webkitgtk",
"version": "2.12.1"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "9.3.2 (ipad 2 or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "9.3.2 (iphone 4s or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "9.3.2 (ipod touch first 5 after generation )"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "9.1.1 (os x el capitan v10.11.5)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "9.1.1 (os x mavericks v10.9.5)"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "9.1.1 (os x yosemite v10.10.5)"
},
{
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "9.2.1 (apple tv first 4 generation )"
},
{
"model": "safari",
"scope": null,
"trust": 0.7,
"vendor": "apple",
"version": null
},
{
"model": "iphone os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "9.3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "9.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "9.2"
},
{
"model": "open source project webkit",
"scope": "eq",
"trust": 0.3,
"vendor": "webkit",
"version": "0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.6"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.5"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.7"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.5"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"db": "BID",
"id": "90689"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"db": "NVD",
"id": "CVE-2016-1854"
},
{
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.3.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.1.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "9.2.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:webkitgtk:webkitgtk\\+:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.12.1",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1854"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Anonymous",
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-341"
}
],
"trust": 0.7
},
"cve": "CVE-2016-1854",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2016-1854",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 1.6,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-90673",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2016-1854",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2016-1854",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2016-1854",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201605-475",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-90673",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2016-1854",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"db": "VULHUB",
"id": "VHN-90673"
},
{
"db": "VULMON",
"id": "CVE-2016-1854"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"db": "NVD",
"id": "CVE-2016-1854"
},
{
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and CVE-2016-1857. Apple iOS , Safari and tvOS Used in etc. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of DataCue objects. By manipulating a document\u0027s elements an attacker can cause a DataCue object in memory to be reused after it has been freed. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Failed exploit attempts may result in a denial-of-service condition. Apple iOS is an operating system developed for mobile devices; watchOS is an operating system for smart watches. Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. \n===========================================================================\nUbuntu Security Notice USN-3079-1\nSeptember 14, 2016\n\nwebkit2gtk vulnerabilities\n===========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in WebKitGTK+. \n\nSoftware Description:\n- webkit2gtk: JavaScript engine library from WebKitGTK+ - GObject introspection\n\nDetails:\n\nA large number of security issues were discovered in the WebKitGTK+ Web and\nJavaScript engines. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 16.04 LTS:\n libjavascriptcoregtk-4.0-18 2.12.5-0ubuntu0.16.04.1\n libwebkit2gtk-4.0-37 2.12.5-0ubuntu0.16.04.1\n\nThis update uses a new upstream release, which includes additional bug\nfixes. After a standard system update you need to restart any applications\nthat use WebKitGTK+, such as Epiphany, to make all the necessary changes. \n\nReferences:\n http://www.ubuntu.com/usn/usn-3079-1\n CVE-2016-1854, CVE-2016-1856, CVE-2016-1857, CVE-2016-1858,\n CVE-2016-1859, CVE-2016-4583, CVE-2016-4585, CVE-2016-4586,\n CVE-2016-4588, CVE-2016-4589, CVE-2016-4590, CVE-2016-4591,\n CVE-2016-4622, CVE-2016-4623, CVE-2016-4624, CVE-2016-4651\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/webkit2gtk/2.12.5-0ubuntu0.16.04.1\n\n\n\n. ------------------------------------------------------------------------\nWebKitGTK+ Security Advisory WSA-2016-0004\n------------------------------------------------------------------------\n\nDate reported : May 30, 2016\nAdvisory ID : WSA-2016-0004\nAdvisory URL : http://webkitgtk.org/security/WSA-2016-0004.html\nCVE identifiers : CVE-2016-1854, CVE-2016-1856, CVE-2016-1857,\n CVE-2016-1858, CVE-2016-1859. \n\nSeveral vulnerabilities were discovered in WebKitGTK+. \n\nCVE-2016-1854\n Versions affected: WebKitGTK+ before 2.12.1. \n\nCVE-2016-1856\n Versions affected: WebKitGTK+ before 2.12.1. \n\nCVE-2016-1857\n Versions affected: WebKitGTK+ before 2.12.3. \n\nCVE-2016-1858\n Versions affected: WebKitGTK+ before 2.12.0. \n Credit to Anonymous. \n\nCVE-2016-1859\n Versions affected: WebKitGTK+ before 2.12.1. \n\n\nWe recommend updating to the last stable version of WebKitGTK+. It is\nthe best way of ensuring that you are running a safe version of\nWebKitGTK+. Please check our website for information about the last\nstable releases. \n\nFurther information about WebKitGTK+ Security Advisories can be found\nat: http://webkitgtk.org/security.html\n\nThe WebKitGTK+ team,\nMay 30, 2016\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2016-05-16-1 tvOS 9.2.1\n\ntvOS 9.2.1 is now available and addresses the following:\n\nCFNetwork Proxies\nAvailable for: Apple TV (4th generation)\nImpact: An attacker in a privileged network position may be able to\nleak sensitive user information\nDescription: An information leak existed in the handling of HTTP and\nHTTPS requests. This issue was addressed through improved URL\nhandling. \nCVE-ID\nCVE-2016-1801 : Alex Chapman and Paul Stone of Context Information\nSecurity\n\nCommonCrypto\nAvailable for: Apple TV (4th generation)\nImpact: A malicious application may be able to leak sensitive user\ninformation\nDescription: An issue existed in the handling of return values in\nCCCrypt. This issue was addressed through improved key length\nmanagement. \nCVE-ID\nCVE-2016-1802 : Klaus Rodewig\n\nCoreCapture\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1803 : Ian Beer of Google Project Zero, daybreaker working\nwith Trend Micro\u2019s Zero Day Initiative\n\nDisk Images\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to read kernel memory\nDescription: A race condition was addressed through improved\nlocking. \nCVE-ID\nCVE-2016-1807 : Ian Beer of Google Project Zero\n\nDisk Images\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue existed in the parsing of\ndisk images. This issue was addressed through improved memory\nhandling. \nCVE-ID\nCVE-2016-1808 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of\nTrend Micro\n\nImageIO\nAvailable for: Apple TV (4th generation)\nImpact: Processing a maliciously crafted image may lead to a denial\nof service\nDescription: A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1811 : Lander Brandt (@landaire)\n\nIOAcceleratorFamily\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1817 : Moony Li (@Flyic) and Jack Tang (@jacktang310) of\nTrend Micro working with Trend Micro\u0027s Zero Day Initiative\nCVE-2016-1818 : Juwei Lin of TrendMicro\n\nIOAcceleratorFamily\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to cause a denial of service\nDescription: A null pointer dereference was addressed through\nimproved locking. \nCVE-ID\nCVE-2016-1819 : Ian Beer of Google Project Zero\n\nIOAcceleratorFamily\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1813 : Ian Beer of Google Project Zero\n\nIOHIDFamily\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1823 : Ian Beer of Google Project Zero\nCVE-2016-1824 : Marco Grassi (@marcograss) of KeenLab (@keen_lab),\nTencent\n\nKernel\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1827 : Brandon Azad\nCVE-2016-1828 : Brandon Azad\nCVE-2016-1829 : CESG\nCVE-2016-1830 : Brandon Azad\n\nlibc\nAvailable for: Apple TV (4th generation)\nImpact: An application may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription: A memory corruption issue was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1832 : Karl Williamson\n\nlibxml2\nAvailable for: Apple TV (4th generation)\nImpact: Processing maliciously crafted XML may lead to an unexpected\napplication termination or arbitrary code execution\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1833 : Mateusz Jurczyk\nCVE-2016-1834 : Apple\nCVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological\nUniversity\nCVE-2016-1837 : Wei Lei and Liu Yang of Nanyang Technological\nUniversity\nCVE-2016-1838 : Mateusz Jurczyk\nCVE-2016-1839 : Mateusz Jurczyk\nCVE-2016-1840 : Kostya Serebryany\n\nlibxslt\nAvailable for: Apple TV (4th generation)\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1847 : Tongbo Luo and Bo Qu of Palo Alto Networks\n\nWebKit\nAvailable for: Apple TV (4th generation)\nImpact: Processing maliciously crafted web content may disclose data\nfrom another website\nDescription: An insufficient taint tracking issue in the parsing of\nsvg images was addressed through improved taint tracking. \nCVE-ID\nCVE-2016-1854 : Anonymous working with Trend Micro\u0027s Zero Day\nInitiative\nCVE-2016-1855 : Tongbo Luo and Bo Qu of Palo Alto Networks\nCVE-2016-1856 : lokihardt working with Trend Micro\u0027s Zero Day\nInitiative\nCVE-2016-1857 : Jeonghoon Shin@A.D.D, Liang Chen, Zhen Feng, wushi of\nKeenLab, Tencent working with Trend Micro\u0027s Zero Day Initiative\n\nWebKit Canvas\nAvailable for: Apple TV (4th generation)\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1859 : Liang Chen, wushi of KeenLab, Tencent working with\nTrend Micro\u0027s Zero Day Initiative\n\nInstallation note:\n\nApple TV will periodically check for software updates. Alternatively,\nyou may manually check for software updates by selecting\n\"Settings -\u003e System -\u003e Software Update -\u003e Update Software.\". \n\nTo check the current version of software, select\n\"Settings -\u003e General -\u003e About\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - https://gpgtools.org\n\niQIcBAEBCgAGBQJXOjzyAAoJEIOj74w0bLRGWI8P/jLFPTwi0qbBczPo3VUwDR07\nZPtJa1T0RXjshbBNgpNde8wiD9ZbYE9/ahrOPlmGupxrX6GKMGPPLtbD3msPlkCp\nBQbo/NgK0+uzkUNhzmS0cwsJNjRfbswIkV4iDBpxTvE+n0LheJqp416XSYlqimtx\nzrNq7Qm3koqdTHafOXMzuOUkD957p1ii9SHJZBGyF68XT2QmEgc+L3lg6QVJ9jwU\nHnQ4SuViEZ+qQKEqmo8ADXkzuJfiPsmeiTDWWCdgLhlM6ucTWxhOXbZP6mbmCBLa\nzc9jW9gjbxBAHOTJqjlqNrAtP01VGf5Vqel+jSOaAAXMrP8Dk4/e26qj6PL6iAu3\nCbHusl8ItSPAUaTMP8K3WVUiseFDWENKMz2i4VS/nZvoaGtHeJefek3RIyaQw1sQ\nIcLqmbMmhUgY8voFHWz9RHMJX7wL6MuZWm2mHFvJ2XKxbQdeLD3d5yABRju9gldn\n/FcSkDmFXqVZKnfFpli877am1Z4jVXBgrWMGdEV3HENhV9WYTyGBZG8eZDTLiQqe\npw8DZufpPZt0U/c2X+/qH5AQjcdStTfzv0xb3MqVh5GP3dZoQnP3nTlGRv2a7Vlf\nv0XdrgNCv2s7CLelv6WiXcEeeVP95XkwNTFf1+oZaZxwFZeY+iAkiR1Z7ItdWlFQ\nbdUbGfVTcdKWfjj6Jwr+\n=CLh/\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1854"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"db": "BID",
"id": "90689"
},
{
"db": "VULHUB",
"id": "VHN-90673"
},
{
"db": "VULMON",
"id": "CVE-2016-1854"
},
{
"db": "PACKETSTORM",
"id": "138715"
},
{
"db": "PACKETSTORM",
"id": "137229"
},
{
"db": "PACKETSTORM",
"id": "137075"
},
{
"db": "PACKETSTORM",
"id": "137089"
}
],
"trust": 3.06
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-90673",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-90673"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-1854",
"trust": 4.0
},
{
"db": "ZDI",
"id": "ZDI-16-341",
"trust": 2.5
},
{
"db": "PACKETSTORM",
"id": "137229",
"trust": 1.9
},
{
"db": "SECTRACK",
"id": "1035888",
"trust": 1.8
},
{
"db": "JVN",
"id": "JVNVU91632741",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-3576",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201605-475",
"trust": 0.7
},
{
"db": "BID",
"id": "90689",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "138715",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-90673",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-1854",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "137075",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "137089",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"db": "VULHUB",
"id": "VHN-90673"
},
{
"db": "VULMON",
"id": "CVE-2016-1854"
},
{
"db": "BID",
"id": "90689"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"db": "PACKETSTORM",
"id": "138715"
},
{
"db": "PACKETSTORM",
"id": "137229"
},
{
"db": "PACKETSTORM",
"id": "137075"
},
{
"db": "PACKETSTORM",
"id": "137089"
},
{
"db": "NVD",
"id": "CVE-2016-1854"
},
{
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
]
},
"id": "VAR-201605-0424",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-90673"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-26T20:07:27.153000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT206568",
"trust": 1.5,
"url": "https://support.apple.com/en-us/ht206568"
},
{
"title": "Apple security updates",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht201222"
},
{
"title": "APPLE-SA-2016-05-16-2 iOS 9.3.2",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2016/may/msg00002.html"
},
{
"title": "APPLE-SA-2016-05-16-1 tvOS 9.2.1",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2016/may/msg00001.html"
},
{
"title": "APPLE-SA-2016-05-16-5 Safari 9.1.1",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2016/may/msg00005.html"
},
{
"title": "HT206564",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht206564"
},
{
"title": "HT206565",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht206565"
},
{
"title": "HT206564",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht206564"
},
{
"title": "HT206565",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht206565"
},
{
"title": "HT206568",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht206568"
},
{
"title": "Apple iOS , watchOS , Safari WebKit Fixes for arbitrary code execution vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=61789"
},
{
"title": "Ubuntu Security Notice: webkit2gtk vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-3079-1"
},
{
"title": "Awesome CVE PoC",
"trust": 0.1,
"url": "https://github.com/lnick2023/nicenice "
},
{
"title": "Awesome CVE PoC",
"trust": 0.1,
"url": "https://github.com/xbl3/awesome-cve-poc_qazbnm456 "
},
{
"title": "Awesome CVE PoC",
"trust": 0.1,
"url": "https://github.com/qazbnm456/awesome-cve-poc "
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"db": "VULMON",
"id": "CVE-2016-1854"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-90673"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"db": "NVD",
"id": "CVE-2016-1854"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2016/may/msg00001.html"
},
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2016/may/msg00002.html"
},
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2016/may/msg00005.html"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/archive/1/538522/100/0/threaded"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht206564"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht206565"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht206568"
},
{
"trust": 1.8,
"url": "http://packetstormsecurity.com/files/137229/webkitgtk-code-execution-denial-of-service-memory-corruption.html"
},
{
"trust": 1.8,
"url": "http://www.zerodayinitiative.com/advisories/zdi-16-341"
},
{
"trust": 1.8,
"url": "http://www.securitytracker.com/id/1035888"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1854"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu91632741/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1854"
},
{
"trust": 0.7,
"url": "https://support.apple.com/en-us/ht206568"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1854"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ios/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/safari/download/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ipad/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/iphone/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ipodtouch/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1856"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1859"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1857"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1858"
},
{
"trust": 0.2,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.2,
"url": "https://gpgtools.org"
},
{
"trust": 0.2,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/3079-1/"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/90689"
},
{
"trust": 0.1,
"url": "http://www.ubuntu.com/usn/usn-3079-1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4623"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4651"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4586"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/webkit2gtk/2.12.5-0ubuntu0.16.04.1"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4591"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4583"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4590"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4624"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4589"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4622"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4585"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4588"
},
{
"trust": 0.1,
"url": "http://webkitgtk.org/security.html"
},
{
"trust": 0.1,
"url": "http://webkitgtk.org/security/wsa-2016-0004.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1823"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1814"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1836"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1829"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1837"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1817"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1839"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1819"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1803"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1827"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1808"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1830"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1813"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1811"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1847"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1828"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1838"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1833"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1807"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1834"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1801"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1818"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1802"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1841"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1840"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1824"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1832"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1855"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1849"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"db": "VULHUB",
"id": "VHN-90673"
},
{
"db": "VULMON",
"id": "CVE-2016-1854"
},
{
"db": "BID",
"id": "90689"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"db": "PACKETSTORM",
"id": "138715"
},
{
"db": "PACKETSTORM",
"id": "137229"
},
{
"db": "PACKETSTORM",
"id": "137075"
},
{
"db": "PACKETSTORM",
"id": "137089"
},
{
"db": "NVD",
"id": "CVE-2016-1854"
},
{
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"db": "VULHUB",
"id": "VHN-90673"
},
{
"db": "VULMON",
"id": "CVE-2016-1854"
},
{
"db": "BID",
"id": "90689"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"db": "PACKETSTORM",
"id": "138715"
},
{
"db": "PACKETSTORM",
"id": "137229"
},
{
"db": "PACKETSTORM",
"id": "137075"
},
{
"db": "PACKETSTORM",
"id": "137089"
},
{
"db": "NVD",
"id": "CVE-2016-1854"
},
{
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-05-19T00:00:00",
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"date": "2016-05-20T00:00:00",
"db": "VULHUB",
"id": "VHN-90673"
},
{
"date": "2016-05-20T00:00:00",
"db": "VULMON",
"id": "CVE-2016-1854"
},
{
"date": "2016-05-16T00:00:00",
"db": "BID",
"id": "90689"
},
{
"date": "2016-05-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"date": "2016-09-14T16:52:04",
"db": "PACKETSTORM",
"id": "138715"
},
{
"date": "2016-05-30T16:44:10",
"db": "PACKETSTORM",
"id": "137229"
},
{
"date": "2016-05-17T15:48:27",
"db": "PACKETSTORM",
"id": "137075"
},
{
"date": "2016-05-17T16:10:15",
"db": "PACKETSTORM",
"id": "137089"
},
{
"date": "2016-05-20T11:00:08.007000",
"db": "NVD",
"id": "CVE-2016-1854"
},
{
"date": "2016-05-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-05-19T00:00:00",
"db": "ZDI",
"id": "ZDI-16-341"
},
{
"date": "2019-03-25T00:00:00",
"db": "VULHUB",
"id": "VHN-90673"
},
{
"date": "2019-03-25T00:00:00",
"db": "VULMON",
"id": "CVE-2016-1854"
},
{
"date": "2016-07-06T14:52:00",
"db": "BID",
"id": "90689"
},
{
"date": "2016-05-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-002848"
},
{
"date": "2019-03-25T17:08:19.553000",
"db": "NVD",
"id": "CVE-2016-1854"
},
{
"date": "2019-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "138715"
},
{
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Used in products Webkit Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-002848"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201605-475"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.