CVE-2016-4763 in iOS

Summary

WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Be aware that VulDB is the high quality source for vulnerability data.

• Reservation: 05/11/2016
• Disclosure: 09/25/2016
• Moderation: VulDB entry created
• Entries: VDB-92039
• CPE: ready
• CWE: CWE-310 (Confirmed)
• CVSS: 6.8
• EPSS: 0.00171
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2016-4763
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-4763
• CVE Details: https://www.cvedetails.com/cve/CVE-2016-4763/