CVE-2016-7598

Description

An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information from process memory via a crafted web site.

CVSS Metrics

• v3.0•MEDIUM•Score: 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.57%• Percentile: 69%

Techniques & Countermeasures

• CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

• apple•icloud

  ≤ 6.0.1

• apple•iphone_os

  ≤ 10.1.1

• apple•itunes

  ≤ 12.5.3

• apple•safari

  ≤ 10.0.1

References (7)

• https://support.apple.com/HT207427
• http://www.securityfocus.com/bid/94907
• https://support.apple.com/HT207421
• http://www.securitytracker.com/id/1037459
• https://support.apple.com/HT207422
• https://security.gentoo.org/glsa/201706-15
• https://support.apple.com/HT207424