CVE-2016-1781 - Vulnerability Details - OpenCVE

WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Iphone Os Safari

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:iphone_os::::::::

No data.

References

Link	Providers
http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html
http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.html
http://www.securityfocus.com/archive/1/537948/100/0/threaded
http://www.securitytracker.com/id/1035353
https://support.apple.com/HT205635
https://support.apple.com/HT205639

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00575}`	epss `{'score': 0.00464}`

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2016-03-24T01:00:00

Updated: 2024-08-05T23:10:39.153Z

Reserved: 2016-01-13T00:00:00

Link: CVE-2016-1781

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-03-24T01:59:48.487

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-1781

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-12-08T00:00:00", "descriptions": [{"lang": "en", "value": "WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/HT205635"}, {"name": "1035353", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1035353"}, {"name": "20160331 WebKitGTK+ Security Advisory WSA-2016-0003", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/537948/100/0/threaded"}, {"name": "APPLE-SA-2015-12-08-5", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.html"}, {"name": "APPLE-SA-2015-12-08-1", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/HT205639"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "product-security@apple.com", "ID": "CVE-2016-1781", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://support.apple.com/HT205635", "refsource": "CONFIRM", "url": "https://support.apple.com/HT205635"}, {"name": "1035353", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1035353"}, {"name": "20160331 WebKitGTK+ Security Advisory WSA-2016-0003", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/537948/100/0/threaded"}, {"name": "APPLE-SA-2015-12-08-5", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.html"}, {"name": "APPLE-SA-2015-12-08-1", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html"}, {"name": "https://support.apple.com/HT205639", "refsource": "CONFIRM", "url": "https://support.apple.com/HT205639"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:10:39.153Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.apple.com/HT205635"}, {"name": "1035353", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1035353"}, {"name": "20160331 WebKitGTK+ Security Advisory WSA-2016-0003", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/537948/100/0/threaded"}, {"name": "APPLE-SA-2015-12-08-5", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.html"}, {"name": "APPLE-SA-2015-12-08-1", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.apple.com/HT205639"}]}]}, "cveMetadata": {"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2016-1781", "datePublished": "2016-03-24T01:00:00", "dateReserved": "2016-01-13T00:00:00", "dateUpdated": "2024-08-05T23:10:39.153Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "F39FC2FB-375B-4129-A37F-BC749F8A9648", "versionEndIncluding": "9.0.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "080450EA-85C1-454D-98F9-5286D69CF237", "versionEndIncluding": "9.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors."}, {"lang": "es", "value": "WebKit en Apple iOS en versiones anteriores a 9.3 y Safari en versiones anteriores a 9.1 no gestiona correctamente las URLs adjuntadas, lo que facilita a servidores web remotos rastrear a usuarios a trav\u00e9s de vectores no especificados."}], "id": "CVE-2016-1781", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-03-24T01:59:48.487", "references": [{"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.html"}, {"source": "product-security@apple.com", "url": "http://www.securityfocus.com/archive/1/537948/100/0/threaded"}, {"source": "product-security@apple.com", "url": "http://www.securitytracker.com/id/1035353"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT205635"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT205639"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/537948/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1035353"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT205635"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT205639"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-19"}], "source": "nvd@nist.gov", "type": "Primary"}]}