Information disclosure in Apple Safari

1) Information disclosure

EUVDB-ID: #VU597

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-4758

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to obtain potentially sensitive information on the target system.
The weakness exists due to permissions flaw in the variable location handling and leads to sensivitive information disclosure.
Successful exploitation of the vulnerability results in access to potentially sensitive data.

Mitigation

Update to 10.0

Vulnerable software versions

Apple Safari: 9.0 - 9.1.3

iTunes: 12.0.1.26 - 12.4.3.1

Apple iOS: 9.0.0 - 9.3.5

External links

http://support.apple.com/en-us/HT207157
http://support.apple.com/en-us/HT207158
http://support.apple.com/en-us/HT207157
http://support.apple.com/cs-cz/HT207143

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.