var-201609-0273
Vulnerability from variot
CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remote attackers to obtain sensitive information via a crafted HTTP response. plural Apple Product CFNetwork Is Set-Cookie There is a vulnerability in which important information can be obtained because the header is analyzed incorrectly. Supplementary information : CWE Vulnerability type by CWE-787: Out-of-bounds Write ( Out-of-bounds writing ) Has been identified. http://cwe.mitre.org/data/definitions/787.htmlSkillfully crafted by a third party HTTP Important information may be obtained through the response. Apple iOS, tvOS,MacOS and watchOS are prone to multiple security vulnerabilities. Attackers can exploit these issues to bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial-of-service condition, perform unauthorized actions and gain system privileges; this may aid in launching further attacks. Versions prior to iOS 10, watchOS 3, MacOS 10.12, and tvOS 10 are vulnerable. Apple iOS, tvOS, OS X, and watchOS are all products of the American company Apple (Apple). Apple iOS is an operating system developed for mobile devices; tvOS is a smart TV operating system; OS X is a dedicated operating system developed for Mac computers; watchOS is a smart watch operating system. CFNetwork is a low-level, high-performance framework that is an extension of BSD sockets (sockets). The vulnerability is caused by the program not correctly parsing the Set-Cookie header. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
APPLE-SA-2016-09-20-3 iOS 10
The iOS 10 advisory has been updated to include additional entries as noted below.
AppleMobileFileIntegrity Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A local application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the task port inheritance policy. This issue was addressed through improved validation of the process entitlement and Team ID. CVE-2016-4698: Pedro VilaASSa Entry added September 20, 2016
Assets Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker in a privileged network position may be able to block a device from receiving software updates Description: An issue existed in iOS updates, which did not properly secure user communications. This issue was addressed by using HTTPS for software updates. CVE-2016-4741: Raul Siles of DinoSec
Audio Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A remote attacker may be able to execute arbitrary code Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4702: YoungJin Yoon, MinSik Shin, HoJae Han, Sunghyun Park, and Taekyoung Kwon of Information Security Lab, Yonsei University Entry added September 20, 2016
Certificate Trust Policy Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Update to the certificate trust policy Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/kb/HT204132. Entry added September 20, 2016
CFNetwork Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A local user may be able to discover websites a user has visited Description: An issue existed in Local Storage deletion. This issue was addressed through improved Local Storage cleanup. CVE-2016-4707: an anonymous researcher Entry added September 20, 2016
CFNetwork Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may compromise user information Description: An input validation issue existed in the parsing of the set-cookie header. This issue was addressed through improved validation checking. CVE-2016-4708: Dawid Czagan of Silesia Security Lab Entry added September 20, 2016
CommonCrypto Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application using CCrypt may disclose sensitive plaintext if the output and input buffer are the same Description: An input validation issue existed in corecrypto. This issue was addressed through improved input validation. CVE-2016-4711: Max Lohrmann Entry added September 20, 2016
CoreCrypto Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code Description: An out-of-bounds write issue was addressed by removing the vulnerable code. CVE-2016-4712: Gergo Koteles Entry added September 20, 2016
FontParser Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking. CVE-2016-4718: Apple Entry added September 20, 2016
GeoServices Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to read sensitive location information Description: A permissions issue existed in PlaceData. This issue was addressed through improved permission validation. CVE-2016-4719: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt)
IDS - Connectivity Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker in a privileged network position may be able to cause a denial of service Description: A spoofing issue existed in the handling of Call Relay. This issue was addressed through improved input validation. CVE-2016-4722: Martin Vigo (@martin_vigo) of salesforce.com Entry added September 20, 2016
IOAcceleratorFamily Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved input validation. CVE-2016-4724: Cererdlong, Eakerqiu of Team OverSky Entry added September 20, 2016
IOAcceleratorFamily Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: A memory corruption issue was addressed through improved input validation. CVE-2016-4725: Rodger Combs of Plex, Inc. Entry added September 20, 2016
IOAcceleratorFamily Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4726: an anonymous researcher Entry added September 20, 2016
Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A local application may be able to access restricted files Description: A parsing issue in the handling of directory paths was addressed through improved path validation. CVE-2016-4771: Balazs Bucsay, Research Director of MRG Effitas Entry added September 20, 2016
Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A remote attacker may be able to cause a denial of service Description: A lock handling issue was addressed through improved lock handling. CVE-2016-4772: Marc Heuse of mh-sec Entry added September 20, 2016
Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to determine kernel memory layout Description: Multiple out-of-bounds read issues existed that led to the disclosure of kernel memory. These were addressed through improved input validation. CVE-2016-4773: Brandon Azad CVE-2016-4774: Brandon Azad CVE-2016-4776: Brandon Azad Entry added September 20, 2016
Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: An untrusted pointer dereference was addressed by removing the affected code. CVE-2016-4777: Lufeng Li of Qihoo 360 Vulcan Team Entry added September 20, 2016
Kernel Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2016-4778: CESG Entry added September 20, 2016
Keyboards Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Keyboard auto correct suggestions may reveal sensitive information Description: The iOS keyboard was inadvertently caching sensitive information. This issue was addressed through improved heuristics. CVE-2016-4746: Antoine M of France
libxml2 Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Multiple issues in libxml2, the most significant of which may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2016-4658: Nick Wellnhofer CVE-2016-5131: Nick Wellnhofer Entry added September 20, 2016
libxslt Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4738: Nick Wellnhofer Entry added September 20, 2016
Mail Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker with a privileged network position may be able to intercept mail credentials Description: An issue existed when handling untrusted certificates. This was addressed by terminating untrusted connections. CVE-2016-4747: Dave Aitel
Messages Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Messages may be visible on a device that has not signed in to Messages Description: An issue existed when using Handoff for Messages. This issue was resolved via better state management. CVE-2016-4740: Step Wallace
Printing UIKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An unencrypted document may be written to a temporary file when using AirPrint preview Description: An issue existed in AirPrint preview. This was addressed through improved environment sanitization. CVE-2016-4749: an anonymous researcher
S2 Camera Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4750: Jack Tang (@jacktang310) and Moony Li of Trend Micro working with Trend Microas Zero Day Initiative Entry added September 20, 2016
Safari Reader Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting Description: Multiple validation issues were addressed through improved input sanitization. CVE-2016-4618: an anonymous researcher Entry added September 20, 2016
Sandbox Profiles Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious application may be able to determine whom a user is texting Description: An access control issue existed in SMS draft directories. This issue was addressed by preventing apps from stat'ing the affected directories. CVE-2016-4620: Razvan Deaconescu, Mihai Chiroiu (University POLITEHNICA of Bucharest); Luke Deshotels, William Enck (North Carolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi (TU Darmstadt)
Security Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in signed disk images. This issue was addressed through improved size validation. CVE-2016-4753: Mark Mentovai of Google Inc. Entry added September 20, 2016
WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A parsing issue existed in the handling of error prototypes. This was addressed through improved validation. CVE-2016-4728: Daniel Divricean Entry added September 20, 2016
WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Visiting a maliciously crafted website may leak sensitive data Description: A permissions issue existed in the handling of the location variable. This was addressed though additional ownership checks. CVE-2016-4758: Masato Kinugawa of Cure53 Entry added September 20, 2016
WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2016-4611: Apple CVE-2016-4729: Apple CVE-2016-4730: Apple CVE-2016-4731: Apple CVE-2016-4734: Natalie Silvanovich of Google Project Zero CVE-2016-4735: AndrA(c) Bargull CVE-2016-4737: Apple CVE-2016-4759: Tongbo Luo of Palo Alto Networks CVE-2016-4762: Zheng Huang of Baidu Security Lab CVE-2016-4766: Apple CVE-2016-4767: Apple CVE-2016-4768: Anonymous working with Trend Micro's Zero Day Initiative Entry added September 20, 2016
WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A malicious website may be able to access non-HTTP services Description: Safari's support of HTTP/0.9 allowed cross-protocol exploitation of non-HTTP services using DNS rebinding. The issue was addressed by restricting HTTP/0.9 responses to default ports and canceling resource loads if the document was loaded with a different HTTP protocol version. CVE-2016-4760: Jordan Milne Entry added September 20, 2016
WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved state management. CVE-2016-4733: Natalie Silvanovich of Google Project Zero CVE-2016-4765: Apple Entry added September 20, 2016
WebKit Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker in a privileged network position may be able to intercept and alter network traffic to applications using WKWebView with HTTPS Description: A certificate validation issue existed in the handling of WKWebView. This issue was addressed through improved validation. CVE-2016-4763: an anonymous researcher Entry added September 20, 2016
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJX4XmJAAoJEIOj74w0bLRGF8MP+QE+9R4gRHqm60pjik77U5BQ QQGDt+VpQrXXCO0OqBiS6d7JLuZz7nBNWp33kRa1McJWgMeeXCOa5z4jlVhD2DPS dCWPjCFfLqaLJ2YZNkCdo5ugULfmq5R5aEdOnbXHl+b9S6boWNsYl2hlMcrPb9FY M7pSLyMuKCpXtQwU8XkHcf+YM7zpZCgBgpgKjIZ6wbMdJPtvkqtDmbpZgX69OeuY Q2imB/Oqgfn741E0Z3qooYPtGIHeGoH3Stonz8vsP6m6Fn24mqQAQ7uJcPc5Vbdv u04GiraN2wry6V9KAJCvnFbybn80SFum4+7l8zKHFQxVBG8Ns4ugxwMrgxWEhyZD q4J1S+dVX10Ir7hDOO+O7b2IA/nmriEbgeUnSxEZ/re62xHP6YT2wdUzAUWUd0xp j3AySRJhi64t1IxRTN3UXReHZgydgU34q6gy38TTie8EIueyLLgnQxDruD/8+Bes PUTjYC+0cbF8XYcvfGQ9CKgePgkc36sosT/JJxSbtmz8TUHmGPrqh4WxoyriIB+F Zldb5fn+TR8K8lSqjw8lb40uknHnUFiAtWDbtSh+eulBxzx2jGqWtihhEag6hbSc 2T/a/XpADjza6iXEojtzj5lNWvCT4SClcjvP+31pmd+8T+aqc8AcfgV+aXdUqhdG nMQ1SmBTu+2VRAwGOc4t =H/Kd -----END PGP SIGNATURE----- .
Alternatively, on your watch, select "My Watch > General > About"
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201609-0273",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "eq",
"trust": 1.4,
"vendor": "apple",
"version": "10.11.6"
},
{
"model": "watchos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "3.0"
},
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.0"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.0"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.12.0"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "2.2.2"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "10 (ipad first 4 after generation )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "10 (iphone 5 or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "10 (ipod touch first 6 after generation )"
},
{
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "10 (apple tv first 4 generation )"
},
{
"model": "watchos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "3 (apple watch all models )"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "9.3.5"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "9.2.2"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "16.10"
},
{
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "16.04"
},
{
"model": "linux lts",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "14.04"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "12.04"
},
{
"model": "dynamic system analysis preboot",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "9.6"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.11.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "50"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "40"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "30"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "dynamic system analysis preboot",
"scope": "ne",
"trust": 0.3,
"vendor": "ibm",
"version": "9.65"
},
{
"model": "watchos",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "tvos",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "macos",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "10.12"
},
{
"model": "ios",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "10"
}
],
"sources": [
{
"db": "BID",
"id": "93054"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"db": "NVD",
"id": "CVE-2016-4708"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.12.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-4708"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "MinSik Shin,YoungJin Yoon, Gergo Koteles, Sunghyun Park, Inc,and Taekyoung Kwon of Information Security Lab, Lufeng Li of Qihoo, Dawid Czagan of Silesia Security Lab, Rodger Combs of Plex, Brandon Azad, HoJae Han, Yonsei University, Marc Heuse of mh-sec",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
],
"trust": 0.6
},
"cve": "CVE-2016-4708",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2016-4708",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-93527",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.5,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2016-4708",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2016-4708",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201609-474",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-93527",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2016-4708",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-93527"
},
{
"db": "VULMON",
"id": "CVE-2016-4708"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"db": "NVD",
"id": "CVE-2016-4708"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remote attackers to obtain sensitive information via a crafted HTTP response. plural Apple Product CFNetwork Is Set-Cookie There is a vulnerability in which important information can be obtained because the header is analyzed incorrectly. Supplementary information : CWE Vulnerability type by CWE-787: Out-of-bounds Write ( Out-of-bounds writing ) Has been identified. http://cwe.mitre.org/data/definitions/787.htmlSkillfully crafted by a third party HTTP Important information may be obtained through the response. Apple iOS, tvOS,MacOS and watchOS are prone to multiple security vulnerabilities. \nAttackers can exploit these issues to bypass security restrictions, obtain sensitive information, execute arbitrary code, cause a denial-of-service condition, perform unauthorized actions and gain system privileges; this may aid in launching further attacks. \nVersions prior to iOS 10, watchOS 3, MacOS 10.12, and tvOS 10 are vulnerable. Apple iOS, tvOS, OS X, and watchOS are all products of the American company Apple (Apple). Apple iOS is an operating system developed for mobile devices; tvOS is a smart TV operating system; OS X is a dedicated operating system developed for Mac computers; watchOS is a smart watch operating system. CFNetwork is a low-level, high-performance framework that is an extension of BSD sockets (sockets). The vulnerability is caused by the program not correctly parsing the Set-Cookie header. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2016-09-20-3 iOS 10\n\nThe iOS 10 advisory has been updated to include additional entries as\nnoted below. \n\nAppleMobileFileIntegrity\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: A local application may be able to execute arbitrary code\nwith system privileges\nDescription: A validation issue existed in the task port inheritance\npolicy. This issue was addressed through improved validation of the\nprocess entitlement and Team ID. \nCVE-2016-4698: Pedro VilaASSa\nEntry added September 20, 2016\n\nAssets\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An attacker in a privileged network position may be able to\nblock a device from receiving software updates\nDescription: An issue existed in iOS updates, which did not properly\nsecure user communications. This issue was addressed by using HTTPS\nfor software updates. \nCVE-2016-4741: Raul Siles of DinoSec\n\nAudio\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: A remote attacker may be able to execute arbitrary code\nDescription: A memory corruption issue was addressed through improved\nmemory handling. \nCVE-2016-4702: YoungJin Yoon, MinSik Shin, HoJae Han, Sunghyun Park,\nand Taekyoung Kwon of Information Security Lab, Yonsei University\nEntry added September 20, 2016\n\nCertificate Trust Policy\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Update to the certificate trust policy\nDescription: The certificate trust policy was updated. The complete\nlist of certificates may be viewed at\nhttps://support.apple.com/kb/HT204132. \nEntry added September 20, 2016\n\nCFNetwork\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: A local user may be able to discover websites a user has\nvisited\nDescription: An issue existed in Local Storage deletion. This issue\nwas addressed through improved Local Storage cleanup. \nCVE-2016-4707: an anonymous researcher\nEntry added September 20, 2016\n\nCFNetwork\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Processing maliciously crafted web content may compromise\nuser information\nDescription: An input validation issue existed in the parsing of the\nset-cookie header. This issue was addressed through improved\nvalidation checking. \nCVE-2016-4708: Dawid Czagan of Silesia Security Lab\nEntry added September 20, 2016\n\nCommonCrypto\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application using CCrypt may disclose sensitive plaintext\nif the output and input buffer are the same\nDescription: An input validation issue existed in corecrypto. This\nissue was addressed through improved input validation. \nCVE-2016-4711: Max Lohrmann\nEntry added September 20, 2016\n\nCoreCrypto\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application may be able to execute arbitrary code\nDescription: An out-of-bounds write issue was addressed by removing\nthe vulnerable code. \nCVE-2016-4712: Gergo Koteles\nEntry added September 20, 2016\n\nFontParser\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: A buffer overflow existed in the handling of font files. \nThis issue was addressed through improved bounds checking. \nCVE-2016-4718: Apple\nEntry added September 20, 2016\n\nGeoServices\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application may be able to read sensitive location\ninformation\nDescription: A permissions issue existed in PlaceData. This issue was\naddressed through improved permission validation. \nCVE-2016-4719: Razvan Deaconescu, Mihai Chiroiu (University\nPOLITEHNICA of Bucharest); Luke Deshotels, William Enck (North\nCarolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi\n(TU Darmstadt)\n\nIDS - Connectivity\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An attacker in a privileged network position may be able to\ncause a denial of service\nDescription: A spoofing issue existed in the handling of Call Relay. \nThis issue was addressed through improved input validation. \nCVE-2016-4722: Martin Vigo (@martin_vigo) of salesforce.com\nEntry added September 20, 2016\n\nIOAcceleratorFamily\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A null pointer dereference was addressed through\nimproved input validation. \nCVE-2016-4724: Cererdlong, Eakerqiu of Team OverSky\nEntry added September 20, 2016\n\nIOAcceleratorFamily\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: A memory corruption issue was addressed through improved\ninput validation. \nCVE-2016-4725: Rodger Combs of Plex, Inc. \nEntry added September 20, 2016\n\nIOAcceleratorFamily\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed through improved\nmemory handling. \nCVE-2016-4726: an anonymous researcher\nEntry added September 20, 2016\n\nKernel\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: A local application may be able to access restricted files\nDescription: A parsing issue in the handling of directory paths was\naddressed through improved path validation. \nCVE-2016-4771: Balazs Bucsay, Research Director of MRG Effitas\nEntry added September 20, 2016\n\nKernel\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A lock handling issue was addressed through improved\nlock handling. \nCVE-2016-4772: Marc Heuse of mh-sec\nEntry added September 20, 2016\n\nKernel\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application may be able to determine kernel memory layout\nDescription: Multiple out-of-bounds read issues existed that led to\nthe disclosure of kernel memory. These were addressed through\nimproved input validation. \nCVE-2016-4773: Brandon Azad\nCVE-2016-4774: Brandon Azad\nCVE-2016-4776: Brandon Azad\nEntry added September 20, 2016\n\nKernel\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: An untrusted pointer dereference was addressed by\nremoving the affected code. \nCVE-2016-4777: Lufeng Li of Qihoo 360 Vulcan Team\nEntry added September 20, 2016\n\nKernel\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: Multiple memory corruption issues were addressed through\nimproved memory handling. \nCVE-2016-4778: CESG\nEntry added September 20, 2016\n\nKeyboards\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Keyboard auto correct suggestions may reveal sensitive\ninformation\nDescription: The iOS keyboard was inadvertently caching sensitive\ninformation. This issue was addressed through improved heuristics. \nCVE-2016-4746: Antoine M of France\n\nlibxml2\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Multiple issues in libxml2, the most significant of which may\nlead to unexpected application termination or arbitrary code\nexecution\nDescription: Multiple memory corruption issues were addressed through\nimproved memory handling. \nCVE-2016-4658: Nick Wellnhofer\nCVE-2016-5131: Nick Wellnhofer\nEntry added September 20, 2016\n\nlibxslt\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed through improved\nmemory handling. \nCVE-2016-4738: Nick Wellnhofer\nEntry added September 20, 2016\n\nMail\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An attacker with a privileged network position may be able to\nintercept mail credentials\nDescription: An issue existed when handling untrusted certificates. \nThis was addressed by terminating untrusted connections. \nCVE-2016-4747: Dave Aitel\n\nMessages\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Messages may be visible on a device that has not signed in to\nMessages\nDescription: An issue existed when using Handoff for Messages. This\nissue was resolved via better state management. \nCVE-2016-4740: Step Wallace\n\nPrinting UIKit\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An unencrypted document may be written to a temporary file\nwhen using AirPrint preview\nDescription: An issue existed in AirPrint preview. This was addressed\nthrough improved environment sanitization. \nCVE-2016-4749: an anonymous researcher\n\nS2 Camera\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed through improved\nmemory handling. \nCVE-2016-4750: Jack Tang (@jacktang310) and Moony Li of Trend Micro\nworking with Trend Microas Zero Day Initiative\nEntry added September 20, 2016\n\nSafari Reader\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Enabling the Safari Reader feature on a maliciously crafted\nwebpage may lead to universal cross site scripting\nDescription: Multiple validation issues were addressed through\nimproved input sanitization. \nCVE-2016-4618: an anonymous researcher\nEntry added September 20, 2016\n\nSandbox Profiles\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: A malicious application may be able to determine whom a user\nis texting\nDescription: An access control issue existed in SMS draft\ndirectories. This issue was addressed by preventing apps from\nstat\u0027ing the affected directories. \nCVE-2016-4620: Razvan Deaconescu, Mihai Chiroiu (University\nPOLITEHNICA of Bucharest); Luke Deshotels, William Enck (North\nCarolina State University); Lucas Vincenzo Davi, Ahmad-Reza Sadeghi\n(TU Darmstadt)\n\nSecurity\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: A malicious application may be able to execute arbitrary code\nwith system privileges\nDescription: A validation issue existed in signed disk images. This\nissue was addressed through improved size validation. \nCVE-2016-4753: Mark Mentovai of Google Inc. \nEntry added September 20, 2016\n\nWebKit\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A parsing issue existed in the handling of error\nprototypes. This was addressed through improved validation. \nCVE-2016-4728: Daniel Divricean\nEntry added September 20, 2016\n\nWebKit\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Visiting a maliciously crafted website may leak sensitive\ndata\nDescription: A permissions issue existed in the handling of the\nlocation variable. This was addressed though additional ownership\nchecks. \nCVE-2016-4758: Masato Kinugawa of Cure53\nEntry added September 20, 2016\n\nWebKit\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed through\nimproved memory handling. \nCVE-2016-4611: Apple\nCVE-2016-4729: Apple\nCVE-2016-4730: Apple\nCVE-2016-4731: Apple\nCVE-2016-4734: Natalie Silvanovich of Google Project Zero\nCVE-2016-4735: AndrA(c) Bargull\nCVE-2016-4737: Apple\nCVE-2016-4759: Tongbo Luo of Palo Alto Networks\nCVE-2016-4762: Zheng Huang of Baidu Security Lab\nCVE-2016-4766: Apple\nCVE-2016-4767: Apple\nCVE-2016-4768: Anonymous working with Trend Micro\u0027s Zero Day\nInitiative\nEntry added September 20, 2016\n\nWebKit\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: A malicious website may be able to access non-HTTP services\nDescription: Safari\u0027s support of HTTP/0.9 allowed cross-protocol\nexploitation of non-HTTP services using DNS rebinding. The issue was\naddressed by restricting HTTP/0.9 responses to default ports and\ncanceling resource loads if the document was loaded with a different\nHTTP protocol version. \nCVE-2016-4760: Jordan Milne\nEntry added September 20, 2016\n\nWebKit\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed through\nimproved state management. \nCVE-2016-4733: Natalie Silvanovich of Google Project Zero\nCVE-2016-4765: Apple\nEntry added September 20, 2016\n\nWebKit\nAvailable for: iPhone 5 and later, iPad 4th generation and later,\niPod touch 6th generation and later\nImpact: An attacker in a privileged network position may be able to\nintercept and alter network traffic to applications using WKWebView\nwith HTTPS\nDescription: A certificate validation issue existed in the handling\nof WKWebView. This issue was addressed through improved validation. \nCVE-2016-4763: an anonymous researcher\nEntry added September 20, 2016\n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - https://gpgtools.org\n\niQIcBAEBCgAGBQJX4XmJAAoJEIOj74w0bLRGF8MP+QE+9R4gRHqm60pjik77U5BQ\nQQGDt+VpQrXXCO0OqBiS6d7JLuZz7nBNWp33kRa1McJWgMeeXCOa5z4jlVhD2DPS\ndCWPjCFfLqaLJ2YZNkCdo5ugULfmq5R5aEdOnbXHl+b9S6boWNsYl2hlMcrPb9FY\nM7pSLyMuKCpXtQwU8XkHcf+YM7zpZCgBgpgKjIZ6wbMdJPtvkqtDmbpZgX69OeuY\nQ2imB/Oqgfn741E0Z3qooYPtGIHeGoH3Stonz8vsP6m6Fn24mqQAQ7uJcPc5Vbdv\nu04GiraN2wry6V9KAJCvnFbybn80SFum4+7l8zKHFQxVBG8Ns4ugxwMrgxWEhyZD\nq4J1S+dVX10Ir7hDOO+O7b2IA/nmriEbgeUnSxEZ/re62xHP6YT2wdUzAUWUd0xp\nj3AySRJhi64t1IxRTN3UXReHZgydgU34q6gy38TTie8EIueyLLgnQxDruD/8+Bes\nPUTjYC+0cbF8XYcvfGQ9CKgePgkc36sosT/JJxSbtmz8TUHmGPrqh4WxoyriIB+F\nZldb5fn+TR8K8lSqjw8lb40uknHnUFiAtWDbtSh+eulBxzx2jGqWtihhEag6hbSc\n2T/a/XpADjza6iXEojtzj5lNWvCT4SClcjvP+31pmd+8T+aqc8AcfgV+aXdUqhdG\nnMQ1SmBTu+2VRAwGOc4t\n=H/Kd\n-----END PGP SIGNATURE-----\n. \n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\"",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-4708"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"db": "BID",
"id": "93054"
},
{
"db": "VULHUB",
"id": "VHN-93527"
},
{
"db": "VULMON",
"id": "CVE-2016-4708"
},
{
"db": "PACKETSTORM",
"id": "138793"
},
{
"db": "PACKETSTORM",
"id": "138795"
},
{
"db": "PACKETSTORM",
"id": "138796"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-4708",
"trust": 3.2
},
{
"db": "BID",
"id": "93054",
"trust": 2.1
},
{
"db": "SECTRACK",
"id": "1036858",
"trust": 1.8
},
{
"db": "JVN",
"id": "JVNVU90950877",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU93841436",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201609-474",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-93527",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-4708",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138793",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138795",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138796",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-93527"
},
{
"db": "VULMON",
"id": "CVE-2016-4708"
},
{
"db": "BID",
"id": "93054"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"db": "PACKETSTORM",
"id": "138793"
},
{
"db": "PACKETSTORM",
"id": "138795"
},
{
"db": "PACKETSTORM",
"id": "138796"
},
{
"db": "NVD",
"id": "CVE-2016-4708"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
]
},
"id": "VAR-201609-0273",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-93527"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:11:49.698000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Apple security updates",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht201222"
},
{
"title": "APPLE-SA-2016-09-20-3 iOS 10",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2016/sep/msg00008.html"
},
{
"title": "APPLE-SA-2016-09-20-5 watchOS 3",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2016/sep/msg00010.html"
},
{
"title": "APPLE-SA-2016-09-20-6 tvOS 10",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2016/sep/msg00011.html"
},
{
"title": "APPLE-SA-2016-09-20 macOS Sierra 10.12",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2016/sep/msg00006.html"
},
{
"title": "HT207142",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht207142"
},
{
"title": "HT207143",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht207143"
},
{
"title": "HT207170",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht207170"
},
{
"title": "HT207141",
"trust": 0.8,
"url": "https://support.apple.com/en-us/ht207141"
},
{
"title": "HT207141",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht207141"
},
{
"title": "HT207142",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht207142"
},
{
"title": "HT207143",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht207143"
},
{
"title": "HT207170",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/ht207170"
},
{
"title": "Apple OS X CFNetwork Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=64346"
},
{
"title": "Apple: watchOS 3",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=22c38e80657dfabed50745bf066b5d7e"
},
{
"title": "Apple: tvOS 10",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=2eacf5c3d1f3eca6b4d1466fef2589d7"
},
{
"title": "Apple: iOS 10",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=49cfe8e7b5abb7b955623b596efe5873"
},
{
"title": "Apple: macOS Sierra 10.12",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=56fe8957a503c1b7b6f00fbd6d759042"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-4708"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-93527"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"db": "NVD",
"id": "CVE-2016-4708"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2016/sep/msg00006.html"
},
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2016/sep/msg00008.html"
},
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2016/sep/msg00010.html"
},
{
"trust": 1.8,
"url": "http://lists.apple.com/archives/security-announce/2016/sep/msg00011.html"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/93054"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht207141"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht207142"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht207143"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht207170"
},
{
"trust": 1.8,
"url": "http://www.securitytracker.com/id/1036858"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4708"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu93841436/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu90950877/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4708"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ios/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/accessibility/tvos/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/watchos-2/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/macosx/"
},
{
"trust": 0.3,
"url": "https://support.apple.com/en-us/ht201222"
},
{
"trust": 0.3,
"url": "https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099662"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4708"
},
{
"trust": 0.3,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.3,
"url": "https://gpgtools.org"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4726"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4702"
},
{
"trust": 0.3,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4712"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4725"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4658"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4737"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4738"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4718"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4728"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4734"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4611"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4733"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4730"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4719"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4735"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4773"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4775"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4778"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4777"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4776"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4774"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4772"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4753"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/vulnerabilities/apple-osx-corecrypto-cve-2016-4712"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht207141"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=48972"
},
{
"trust": 0.1,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4707"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4740"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht204132."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4620"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4618"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4711"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4741"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4731"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4729"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4722"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4698"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4724"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4746"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht204641"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5131"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4767"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4766"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4768"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4765"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-4759"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-93527"
},
{
"db": "VULMON",
"id": "CVE-2016-4708"
},
{
"db": "BID",
"id": "93054"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"db": "PACKETSTORM",
"id": "138793"
},
{
"db": "PACKETSTORM",
"id": "138795"
},
{
"db": "PACKETSTORM",
"id": "138796"
},
{
"db": "NVD",
"id": "CVE-2016-4708"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-93527"
},
{
"db": "VULMON",
"id": "CVE-2016-4708"
},
{
"db": "BID",
"id": "93054"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"db": "PACKETSTORM",
"id": "138793"
},
{
"db": "PACKETSTORM",
"id": "138795"
},
{
"db": "PACKETSTORM",
"id": "138796"
},
{
"db": "NVD",
"id": "CVE-2016-4708"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-09-25T00:00:00",
"db": "VULHUB",
"id": "VHN-93527"
},
{
"date": "2016-09-25T00:00:00",
"db": "VULMON",
"id": "CVE-2016-4708"
},
{
"date": "2016-09-20T00:00:00",
"db": "BID",
"id": "93054"
},
{
"date": "2016-09-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"date": "2016-09-20T18:22:22",
"db": "PACKETSTORM",
"id": "138793"
},
{
"date": "2016-09-20T17:02:22",
"db": "PACKETSTORM",
"id": "138795"
},
{
"date": "2016-09-20T18:32:22",
"db": "PACKETSTORM",
"id": "138796"
},
{
"date": "2016-09-25T10:59:15.687000",
"db": "NVD",
"id": "CVE-2016-4708"
},
{
"date": "2016-09-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-13T00:00:00",
"db": "VULHUB",
"id": "VHN-93527"
},
{
"date": "2019-03-13T00:00:00",
"db": "VULMON",
"id": "CVE-2016-4708"
},
{
"date": "2017-12-25T12:00:00",
"db": "BID",
"id": "93054"
},
{
"date": "2016-09-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004930"
},
{
"date": "2019-03-13T14:31:43.790000",
"db": "NVD",
"id": "CVE-2016-4708"
},
{
"date": "2019-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Apple Product CFNetwork Vulnerability in which important information is obtained",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004930"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201609-474"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.