VulnerabilityModified
CVE-2016-1779
WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request.
MEDIUM 6.5EPSS 2.82%
Does this matter?
Lower severity and a low EPSS score (2.82%). Track it; it rarely justifies an emergency change on its own.
Description
WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 2.82% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apple/safari · apple/iphone os
- Source
- product-security@apple.com
References
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.htmlVendor Advisory
- http://www.securityfocus.com/archive/1/537948/100/0/threaded
- http://www.securitytracker.com/id/1035353
- https://support.apple.com/HT206166Vendor Advisory
- https://support.apple.com/HT206171Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.htmlVendor Advisory
- http://www.securityfocus.com/archive/1/537948/100/0/threaded
- http://www.securitytracker.com/id/1035353
- https://support.apple.com/HT206166Vendor Advisory
- https://support.apple.com/HT206171Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.