CVE-2016-4583

LOW 3.1CVE-2016-4583 · Published 22/07/2016 · updated 17/06/2026

In short

CVE-2016-4583 is a LOW (CVSS 3.1) vulnerability affecting webkitgtk+ (webkitgtk).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.9% of all vulnerabilities.
Fix: update to 2.12.2 or later.

Package	Affected versions	Patched versions
webkitgtk+ webkitgtk	`< 2.12.2`	`2.12.2`

Description

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.

References

lists.apple.com/archives/security-announce/2016/Jul/msg00001.html · Mailing List
lists.apple.com/archives/security-announce/2016/Jul/msg00003.html · Mailing List
lists.apple.com/archives/security-announce/2016/Jul/msg00004.html · Mailing List
packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html · Third Party Advisory
securityfocus.com/archive/1/539295/100/0/threaded · Third Party Advisory
securityfocus.com/bid/91830 · Third Party Advisory
securitytracker.com/id/1036343 · Third Party Advisory
support.apple.com/HT206900 · Vendor Advisory
support.apple.com/HT206902 · Vendor Advisory
support.apple.com/HT206905 · Vendor Advisory

More vulnerabilities in webkitgtk+

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

webkitgtk+

webkitgtk

< 2.12.2

2.12.2

More vulnerabilities in webkitgtk+

See all →