CVE-2016-1724
Publication date 1 February 2016
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1727.
Status
Package | Ubuntu Release | Status |
---|---|---|
qtwebkit-opensource-src | ||
16.04 LTS xenial | Ignored no update available | |
14.04 LTS trusty | Not in release | |
qtwebkit-source | ||
16.04 LTS xenial | Ignored no update available | |
14.04 LTS trusty | Not in release | |
webkit | ||
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
webkit2gtk | ||
16.04 LTS xenial |
Not affected
|
|
14.04 LTS trusty | Not in release | |
webkitgtk | ||
16.04 LTS xenial | Ignored no update available | |
14.04 LTS trusty | Not in release | |
Notes
jdstrand
webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8
Severity score breakdown
Parameter | Value |
---|---|
Base score | 8.8 · High |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
References
Other references
- https://support.apple.com/HT205732
- https://support.apple.com/HT205730
- https://support.apple.com/HT205729
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html
- http://webkitgtk.org/security/WSA-2016-0002.html
- https://www.cve.org/CVERecord?id=CVE-2016-1724