Spoofing attack in Apple Safari and Apple iOS - CVE-2016-4590

Vulnerability identifier: #VU170

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-4590

CWE-ID: CWE-451

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a spoofing attacks.

The vulnerability exists due to a flaw in the parsing of 'about:' URL. A remote unauthenticated attacker can create a specially crafted web site to exploit this vulnerability and spoof user interface elements.

Successful exploitation of this vulnerability may result in disclosure of user information.

Apple Safari
Apple iOS
Fedora
webkit2gtk (Alpine package)
webkitgtk4

The vendor has issued a fix (9.1.2).

webkit2gtk (Alpine package) - update to 2.12.5-r0
webkitgtk4 - addressed in versions 2.12.4-1.fc23, 2.12.4-1.fc24

• https://support.apple.com/en-us/HT206900
• https://support.apple.com/cs-cz/HT206900

• Spoofing attack in Apple Safari
• Spoofing attack in webkit2gtk (Alpine package)
• Fedora 23 update for webkitgtk4
• Fedora 24 update for webkitgtk4