{"id":"CVE-2016-4583","aliases":["EUVD-2016-5569","GHSA-prfv-fm4x-p4rr","UBUNTU-CVE-2016-4583","USN-3079-1"],"status":"published","title":"WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote...","description":"WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.","severity":{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01829,"percentile":0.78984,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2016-07-21T00:00:00Z","modified":"2026-10-08T12:49:51Z","fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","fixed_in":["2.12.5-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-0ubuntu0.16.04.1"}]}],"versions":["2.8.5+dfsg1-3","2.10.3+dfsg1-1","2.10.4+dfsg1-1","2.10.5-1","2.10.6-1","2.10.6-1ubuntu1","2.10.8-1ubuntu1","2.10.9-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-1ubuntu2.1","5.5.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu10","2.3.2-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkit2gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-0ubuntu0.16.04.1"}]}],"versions":["2.8.5+dfsg1-3","2.10.3+dfsg1-1","2.10.4+dfsg1-1","2.10.5-1","2.10.6-1","2.10.6-1ubuntu1","2.10.8-1ubuntu1","2.10.9-1ubuntu1"],"bundled":16}],"products":[{"vendor":"apple","product":"webkit"},{"vendor":"webkitgtk","product":"webkitgtk\\+"}],"references":[{"url":"http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory","report"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory","report"]},{"url":"http://www.securityfocus.com/bid/91830","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://support.apple.com/HT206900","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://www.securitytracker.com/id/1036343","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/539295/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://support.apple.com/HT206905","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"https://support.apple.com/HT206902","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4583"},{"url":"https://github.com/advisories/GHSA-prfv-fm4x-p4rr"},{"url":"https://ubuntu.com/security/CVE-2016-4583","tags":["report"]},{"url":"https://webkitgtk.org/security/WSA-2016-0005.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3079-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4586","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4651","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4583","description":"WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.","status":"published","published":"2016-07-22T01:00:00Z","modified":"2024-08-06T00:32:25.883Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5569","description":"WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.","status":"published","published":"2016-07-22T01:00:00Z","modified":"2024-08-06T00:32:25Z","updated_at":"2026-11-03T02:22:45.901874Z"}],"ghsa":[{"id":"GHSA-prfv-fm4x-p4rr","title":"WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote...","description":"WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.","status":"published","published":"2022-05-14T01:18:44Z","modified":"2023-02-02T05:03:39Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:51:41.084259Z"}],"nvd":[{"id":"CVE-2016-4583","description":"WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.","status":"published","published":"2016-07-22T02:59:05.583Z","modified":"2026-06-17T00:47:50.283Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"UBUNTU-CVE-2016-4583","description":"WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.","status":"published","published":"2016-07-21T00:00:00Z","modified":"2026-10-08T12:49:51.354332944Z","cvss":[{"version":"3.0","score":3.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"USN-3079-1","title":"webkit2gtk vulnerabilities","description":"A large number of security issues were discovered in the WebKitGTK+ Web and\nJavaScript engines. If a user were tricked into viewing a malicious\nwebsite, a remote attacker could exploit a variety of issues related to web\nbrowser security, including cross-site scripting attacks, denial of service\nattacks, and arbitrary code execution.\n","status":"published","published":"2016-09-14T13:06:54Z","modified":"2026-04-22T09:27:47.239406Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}