A vulnerability was found in Apple Safari up to 9 (Web Browser) and classified as critical. This issue affects some unknown functionality of the component WebKit. The manipulation with an unknown input leads to a resource management vulnerability. Using CWE to declare the problem leads to CWE-399. Impacted is confidentiality, integrity, and availability.

The weakness was shared 03/18/2016 by 0x1byte as HT206171 as confirmed advisory (Website) via ZDI (Zero Day Initiative). It is possible to read the advisory at support.apple.com. The identification of this vulnerability is CVE-2016-1778 since 01/12/2016. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The advisory points out:

Multiple memory corruption issues were addressed through improved memory handling.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 124837 (Apple Safari 9.1 Not Installed (APPLE-SA-2016-03-21-6)).

Upgrading to version 9.1 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entries 81414, 81415, 81416 and 81420 are related to this item.

Productinfo

Type

• Web Browser

Vendor

• Apple

Name

• Safari

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion