VulnerabilityModified
CVE-2016-1849
The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read…
LOW 3.3EPSS 0.32%
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory.
- CVSS 3.0
- 3.3 LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.32% probability · 25th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apple/safari · apple/iphone os
- Source
- product-security@apple.com
References
- http://lists.apple.com/archives/security-announce/2016/May/msg00002.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/May/msg00005.htmlVendor Advisory
- http://www.securitytracker.com/id/1035888
- https://support.apple.com/HT206565Vendor Advisory
- https://support.apple.com/HT206568Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/May/msg00002.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/May/msg00005.htmlVendor Advisory
- http://www.securitytracker.com/id/1035888
- https://support.apple.com/HT206565Vendor Advisory
- https://support.apple.com/HT206568Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.