{"id":"CVE-2016-4758","aliases":["EUVD-2016-5743","GHSA-2qj9-5hwh-h764","MGASA-2017-0069","UBUNTU-CVE-2016-4758"],"status":"published","title":"WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not...","description":"WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01709,"percentile":0.7749,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2016-09-25T10:00:00Z","modified":"2026-10-08T12:49:49Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"webkit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.5-1.mga5"}]}],"bundled":60},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-1ubuntu2.1","5.5.1+dfsg-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtwebkit-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-0ubuntu10","2.3.2-0ubuntu11"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.9-2ubuntu2","2.4.10-0ubuntu1","2.4.11-0ubuntu0.1"]}],"products":[{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"itunes"},{"vendor":"apple","product":"safari"}],"references":[{"url":"http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory","report"]},{"url":"https://support.apple.com/HT207157","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"https://support.apple.com/HT207158","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://www.securityfocus.com/bid/93066","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securitytracker.com/id/1036854","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://support.apple.com/HT207143","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory","report"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4758"},{"url":"https://github.com/advisories/GHSA-2qj9-5hwh-h764"},{"url":"https://advisories.mageia.org/MGASA-2017-0069.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19721","tags":["report"]},{"url":"https://webkitgtk.org/security/WSA-2016-0006.html","tags":["web","report"]},{"url":"https://webkitgtk.org/security/WSA-2017-0001.html","tags":["web"]},{"url":"https://webkitgtk.org/security/WSA-2017-0002.html","tags":["web"]},{"url":"https://webkitgtk.org/2016/09/05/webkitgtk2.12.5-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2016/09/20/webkitgtk2.14.0-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2016/10/11/webkitgtk2.14.1-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2016/11/03/webkitgtk2.14.2-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2017/01/17/webkitgtk2.14.3-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2017/02/10/webkitgtk2.14.4-released.html","tags":["web"]},{"url":"https://webkitgtk.org/2017/02/15/webkitgtk2.14.5-released.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4758","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4758","description":"WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.","status":"published","published":"2016-09-25T10:00:00Z","modified":"2024-08-06T00:39:26.118Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5743","description":"WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.","status":"published","published":"2016-09-25T10:00:00Z","modified":"2024-08-06T00:39:26Z","updated_at":"2026-11-03T02:22:44.916959Z"}],"ghsa":[{"id":"GHSA-2qj9-5hwh-h764","title":"WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not...","description":"WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.","status":"published","published":"2022-05-17T02:22:10Z","modified":"2023-01-27T05:04:50Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:42:33.466157Z"}],"nvd":[{"id":"CVE-2016-4758","description":"WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.","status":"published","published":"2016-09-25T10:59:52.83Z","modified":"2026-06-17T00:48:09.813Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"UBUNTU-CVE-2016-4758","description":"WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.","status":"published","published":"2016-09-25T10:59:00Z","modified":"2026-10-08T12:49:49.672599182Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"MGASA-2017-0069","title":"Updated webkit2 packages fix security vulnerabilities","description":"The webkit2 package has been updated to version 2.14.5, fixing several\nsecurity issues and other bugs.\n","status":"published","published":"2017-03-02T15:11:17Z","modified":"2026-04-16T06:26:13.364299176Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}