deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4694
Published: 2016-09-25
Description: The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted CGI client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue, a related issue to CVE-2016-5387.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00009.html; http://www.securityfocus.com/bid/93060
CVE: CVE-2016-4696
Published: 2016-09-25
Description: AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4697
Published: 2016-09-25
Description: Apple HSSPI Support in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4698
Published: 2016-09-25
Description: AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93056
CVE: CVE-2016-4699
Published: 2016-09-25
Description: AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4700.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4700
Published: 2016-09-25
Description: AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4699.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4701
Published: 2016-09-25
Description: Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SO_EXECPATH environment variable.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4702
Published: 2016-09-25
Description: Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4703
Published: 2016-09-25
Description: Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4706
Published: 2016-09-25
Description: cd9660 in Apple OS X before 10.12 allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4707
Published: 2016-09-25
Description: CFNetwork in Apple iOS before 10 and OS X before 10.12 mishandles Local Storage deletion, which allows local users to discover the visited web sites of arbitrary users via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-19, CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93056
CVE: CVE-2016-4708
Published: 2016-09-25
Description: CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remote attackers to obtain sensitive information via a crafted HTTP response.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4709
Published: 2016-09-25
Description: WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4710.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4710
Published: 2016-09-25
Description: WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4709.
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4711
Published: 2016-09-25
Description: CCrypt in corecrypto in CommonCrypto in Apple iOS before 10 and OS X before 10.12 allows attackers to discover cleartext information by leveraging a function call that specifies the same buffer for input and output.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93056
CVE: CVE-2016-4712
Published: 2016-09-25
Description: CoreCrypto in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4713
Published: 2016-09-25
Description: CoreDisplay in Apple OS X before 10.12 allows attackers to view arbitrary users' screens by leveraging screen-sharing access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4715
Published: 2016-09-25
Description: The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via a crafted app.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4716
Published: 2016-09-25
Description: diskutil in DiskArbitration in Apple OS X before 10.12 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4717
Published: 2016-09-25
Description: The File Bookmark component in Apple OS X before 10.12 mishandles scoped-bookmark file descriptors, which allows attackers to cause a denial of service via a crafted app.
CVSS Score: 3.3 (LOW)
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4718
Published: 2016-09-25
Description: Buffer overflow in FontParser in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to obtain sensitive information from process memory via a crafted font file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4722
Published: 2016-09-25
Description: The IDS - Connectivity component in Apple iOS before 10 and OS X before 10.12 allows man-in-the-middle attackers to conduct Call Relay spoofing attacks and cause a denial of service via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93056
CVE: CVE-2016-4723
Published: 2016-09-25
Description: Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4724
Published: 2016-09-25
Description: IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93056
CVE: CVE-2016-4725
Published: 2016-09-25
Description: IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted web site.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4726
Published: 2016-09-25
Description: IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4727
Published: 2016-09-25
Description: IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4728
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4729
Published: 2016-09-25
Description: WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4731.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93053
CVE: CVE-2016-4730
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4731
Published: 2016-09-25
Description: WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4729.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93053
CVE: CVE-2016-4733
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4734, and CVE-2016-4735.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4734
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4735.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4735
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4734.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4736
Published: 2016-09-25
Description: libarchive in Apple OS X before 10.12 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4737
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, Safari before 10, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4738
Published: 2016-09-25
Description: libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4739
Published: 2016-09-25
Description: mDNSResponder in Apple OS X before 10.12, when VMnet.framework is used, arranges for a DNS proxy to listen on all interfaces, which allows remote attackers to obtain sensitive information by sending a DNS query to an unintended interface.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4742
Published: 2016-09-25
Description: NSSecureTextField in Apple OS X before 10.12 does not enable Secure Input, which allows attackers to discover credentials via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4745
Published: 2016-09-25
Description: The Kerberos 5 (aka krb5) PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4748
Published: 2016-09-25
Description: Perl in Apple OS X before 10.12 allows local users to bypass the taint-mode protection mechanism via a crafted environment variable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4750
Published: 2016-09-25
Description: S2 Camera in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93056
CVE: CVE-2016-4751
Published: 2016-09-25
Description: The Safari Tabs component in Apple Safari before 10 allows remote attackers to spoof the address bar of a tab via a crafted web site.
CVSS Score: 3.5 (LOW)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://www.securityfocus.com/bid/93058; http://www.securitytracker.com/id/1036854
CVE: CVE-2016-4752
Published: 2016-09-25
Description: The SecKeyDeriveFromPassword function in Apple OS X before 10.12 does not use the CF_RETURNS_RETAINED keyword, which allows attackers to obtain sensitive information from process memory by triggering key derivation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4753
Published: 2016-09-25
Description: Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 mishandle signed disk images, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4754
Published: 2016-09-25
Description: ServerDocs Server in Apple OS X Server before 5.2 supports the RC4 cipher, which might allow remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00009.html; http://www.securityfocus.com/bid/93061; http://www.securitytracker.com/id/1036853
CVE: CVE-2016-4755
Published: 2016-09-25
Description: Terminal in Apple OS X before 10.12 uses weak permissions for the .bash_history and .bash_session files, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-4758
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
CVE: CVE-2016-4759
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4765, CVE-2016-4766, CVE-2016-4767, and CVE-2016-4768.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html