Memory corruption in Apple Inc. products - CVE-2016-4584
Published: July 19, 2016 / Updated: November 22, 2018
Vulnerability identifier: #VU168
CSH Severity: Critical
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-4584
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to input validation error in Apple Safari. A remote unauthenticated attacker can cause arbitrary code execution by creating a specially crafted web site that, when loaded by the target user, will trigger a memory corruption error in WebKit.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
The vulnerability exists due to input validation error in Apple Safari. A remote unauthenticated attacker can cause arbitrary code execution by creating a specially crafted web site that, when loaded by the target user, will trigger a memory corruption error in WebKit.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Apple Safari
tvOS
Apple iOS
tvOS
Apple iOS
How to mitigate CVE-2016-4584
The vendor has issued a fix (9.1.2).