CVE-2016-1785
Publication date 24 March 2016
Last updated 25 August 2025
Ubuntu priority
Description
The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| qtwebkit-opensource-src | ||
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Not in release | |
| qtwebkit-source | ||
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Not in release | |
| webkit | ||
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| webkit2gtk | ||
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty | Not in release | |
| webkitgtk | ||
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Not in release | |
Notes
jdstrand
webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.5 · Medium
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
Other references
- https://support.apple.com/HT206171
- https://support.apple.com/HT206166
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00005.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
- https://webkitgtk.org/security/WSA-2016-0003.html
- https://www.cve.org/CVERecord?id=CVE-2016-1785