CVEvulnerability
CVE-2016-4763
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-09-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.8 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.9 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:N
- Weaknesses
- CWE-310
Description
WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected configurations
• apple itunes (<= 12.4.3)
• apple safari (<= 9.1.3)
• apple iphone os (<= 9.3.5)
Related
Weakness · not in database (1)
References
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html Mailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html Mailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html Mailing List, Vendor Advisory
- http://www.securityfocus.com/bid/93066 www.securityfocus.com
- http://www.securitytracker.com/id/1036854 www.securitytracker.com
- https://support.apple.com/HT207143 Vendor Advisory
- https://support.apple.com/HT207157 Vendor Advisory
- https://support.apple.com/HT207158 Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html Mailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html Mailing List, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html Mailing List, Vendor Advisory
- http://www.securityfocus.com/bid/93066 www.securityfocus.com
- http://www.securitytracker.com/id/1036854 www.securitytracker.com
- https://support.apple.com/HT207143 Vendor Advisory
- https://support.apple.com/HT207157 Vendor Advisory
- https://support.apple.com/HT207158 Vendor Advisory