SB2017022022 - Improper access control in webkit2gtk (Alpine package)
Published: February 20, 2017
Security Bulletin ID
SB2017022022
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper access control (CVE-ID: CVE-2016-4591)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
Remediation
Install update from vendor's website.