Sign-up

ID

VAR-201605-0475


CVE

CVE-2016-1849


TITLE

Apple iOS Used in products such as Safari "History and Web Vulnerability in which important information is obtained in the "Erase Site Data" function

Trust: 0.8

sources: JVNDB: JVNDB-2016-002843

DESCRIPTION

The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory. Apple Safari is prone to an unspecified security vulnerability. Little is known about this issue or its effects at this time. We will update this BID as more information emerges. Versions prior to Safari 9.1.1 are vulnerable. Apple iOS and Apple Safari are both products of Apple (Apple). Apple iOS is an operating system developed for mobile devices; Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-05-16-5 Safari 9.1.1 Safari 9.1.1 is now available and addresses the following: Safari Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.5 Impact: A user may be unable to fully delete browsing history Description: "Clear History and Website Data" did not clear the history. The issue was addressed through improved data deletion. CVE-ID CVE-2016-1849 : Adham Ghrayeb WebKit Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.5 Impact: Visiting a malicious website may disclose data from another website Description: An insufficient taint tracking issue in the parsing of svg images was addressed through improved taint tracking. CVE-ID CVE-2016-1858 : an anonymous researcher WebKit Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.5 Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1854 : Anonymous working with Trend Micro's Zero Day Initiative CVE-2016-1855 : Tongbo Luo and Bo Qu of Palo Alto Networks CVE-2016-1856 : lokihardt working with Trend Micro's Zero Day Initiative CVE-2016-1857 : Jeonghoon Shin@A.D.D, Liang Chen, Zhen Feng, wushi of KeenLab, Tencent working with Trend Micro's Zero Day Initiative WebKit Canvas Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.5 Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1859 : Liang Chen, wushi of KeenLab, Tencent working with Trend Micro's Zero Day Initiative Safari 9.1.1 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJXOj0LAAoJEIOj74w0bLRGg00P/15+B1ltGhgazsTVc8eZVaC+ LVe24/wN8yTv8I5N23JLFRcMopJj7GFSEU+ApYvgkgw2U3w5sku7Vz0scG2YYHca ubfUP3GdIsNlgaDMUvBCS3dUyzbK85AYZHhcAvQ4nL60Ttjk2wi9YpnKuY7eTEwi GnMmfuRdmsN6pEIUofCrwtYw2zC4Yte/iyxZSc9vQthqjLqn992FBrWZO6NLnhK8 P1NusAo/Eby/Z8xftS+foHGEcZg2zuKDkJsoHgN+HwiuO8bdiA9ZeqbH2iQIymbo N/PRIP2E1W/RXFodit16oA3PjoHs813WOyoc85mG8yLNOoLXcdpSWqosDKUhrXsF FL4H+O0XCUUDEzYr+kyqj+tvNn3UwnNEcW6ZgyrWBU2w93CG1MpR9eTr4o/xxLd3 2gN4mj8PvK/Or2TVKFBB5rRb+SIKjPqrDyB/NJyqnaLurnuEYjMZv7nM6U3HDFql XxZ3b3jq0uoBXOAAiSm1g6MFgcjkZLcvM55CkljQha5SKCgrUnZ52jsDPqXGfNL7 CUcTUQ8VTtXknASYo6c1dOZs0snCkHNK84iFZdELwQz8t4R6ERH0YmV8yuplqOe2 SoYDJig8OkfdQK3HaL6MTNn7flwAsb/YV17nVYZxINYbkF88ticAH4l/KuCPQyXL 6xvn35QzPS6xQsexYsbi =Ybx7 -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2016-1849 // JVNDB: JVNDB-2016-002843 // BID: 90690 // VULHUB: VHN-90668 // VULMON: CVE-2016-1849 // PACKETSTORM: 137089

AFFECTED PRODUCTS

vendor:applemodel:safariscope:lteversion:9.1

Trust: 1.0

vendor:applemodel:iphone osscope:lteversion:9.3.1

Trust: 1.0

vendor:applemodel:iosscope:ltversion:9.3.2 (ipad 2 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:9.3.2 (iphone 4s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:9.3.2 (ipod touch first 5 after generation )

Trust: 0.8

vendor:applemodel:safariscope:ltversion:9.1.1 (os x el capitan v10.11.5)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:9.1.1 (os x mavericks v10.9.5)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:9.1.1 (os x yosemite v10.10.5)

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:9.3.1

Trust: 0.6

vendor:applemodel:safariscope:eqversion:9.1

Trust: 0.6

vendor:applemodel:safariscope:eqversion:5.0.6

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.0.5

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.0.4

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.0.3

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:3.2.3

Trust: 0.3

vendor:applemodel:safariscope:eqversion:3.1.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:3.1.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:2.0.4

Trust: 0.3

vendor:applemodel:safariscope:eqversion:2.0.3

Trust: 0.3

vendor:applemodel:safariscope:eqversion:2.0.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:2.0.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.3.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.3.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.3

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.2.3

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.2.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.2.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:1.0

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.1.7

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.1.4

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.0.5

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.0.4

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.0.3

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.0.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:5.0

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.1.3

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.1.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.1.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4.0

Trust: 0.3

vendor:applemodel:safariscope:eqversion:4

Trust: 0.3

vendor:applemodel:safariscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:safariscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:safariscope:eqversion:3

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

sources: BID: 90690 // JVNDB: JVNDB-2016-002843 // CNNVD: CNNVD-201605-504 // NVD: CVE-2016-1849

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1849
value: LOW

Trust: 1.0

NVD: CVE-2016-1849
value: LOW

Trust: 0.8

CNNVD: CNNVD-201605-504
value: LOW

Trust: 0.6

VULHUB: VHN-90668
value: LOW

Trust: 0.1

VULMON: CVE-2016-1849
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2016-1849
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-90668
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1849
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 1.4
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-90668 // VULMON: CVE-2016-1849 // JVNDB: JVNDB-2016-002843 // CNNVD: CNNVD-201605-504 // NVD: CVE-2016-1849

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-90668 // JVNDB: JVNDB-2016-002843 // NVD: CVE-2016-1849

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201605-504

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201605-504

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-002843

PATCH
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:APPLE-SA-2016-05-16-5 Safari 9.1.1url:http://lists.apple.com/archives/security-announce/2016/May/msg00005.html
Trust: 0.8
title:APPLE-SA-2016-05-16-2 iOS 9.3.2url:http://lists.apple.com/archives/security-announce/2016/May/msg00002.html
Trust: 0.8
title:HT206568url:https://support.apple.com/en-us/HT206568
Trust: 0.8
title:HT206565url:https://support.apple.com/en-us/HT206565
Trust: 0.8
title:HT206565url:https://support.apple.com/ja-jp/HT206565
Trust: 0.8
title:HT206568url:https://support.apple.com/ja-jp/HT206568
Trust: 0.8
title:Apple iOS  and Safari Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61818
Trust: 0.6
title:Apple: Safari 9.1.1url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=ddf1c09af624faca2277f8dc728cb81e
Trust: 0.1
title:Apple: iOS 9.3.2url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=d85657e8623d63e2afdb2287247cdad6
Trust: 0.1
sources:
            
            
            VULMON: CVE-2016-1849 // 
            
            
            
            JVNDB: JVNDB-2016-002843 // 
            
            
            
            CNNVD: CNNVD-201605-504

EXTERNAL IDS
db:NVDid:CVE-2016-1849
Trust: 3.0
db:SECTRACKid:1035888
Trust: 1.2
db:JVNid:JVNVU91632741
Trust: 0.8
db:JVNDBid:JVNDB-2016-002843
Trust: 0.8
db:CNNVDid:CNNVD-201605-504
Trust: 0.7
db:BIDid:90690
Trust: 0.5
db:PACKETSTORMid:137089
Trust: 0.2
db:VULHUBid:VHN-90668
Trust: 0.1
db:VULMONid:CVE-2016-1849
Trust: 0.1
sources:
            
            
            VULHUB: VHN-90668 // 
            
            
            
            VULMON: CVE-2016-1849 // 
            
            
            
            BID: 90690 // 
            
            
            
            JVNDB: JVNDB-2016-002843 // 
            
            
            
            PACKETSTORM: 137089 // 
            
            
            
            CNNVD: CNNVD-201605-504 // 
            
            
            
            NVD: CVE-2016-1849

REFERENCES
url:http://lists.apple.com/archives/security-announce/2016/may/msg00002.html
Trust: 1.8
url:http://lists.apple.com/archives/security-announce/2016/may/msg00005.html
Trust: 1.8
url:https://support.apple.com/ht206565
Trust: 1.8
url:https://support.apple.com/ht206568
Trust: 1.8
url:http://www.securitytracker.com/id/1035888
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1849
Trust: 0.8
url:http://jvn.jp/vu/jvnvu91632741/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1849
Trust: 0.8
url:http://www.apple.com/ios/
Trust: 0.3
url:http://www.apple.com/safari/download/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/200.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.securityfocus.com/bid/90690
Trust: 0.1
url:https://support.apple.com/kb/ht206565
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1854
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1856
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1855
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1849
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://gpgtools.org
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1859
Trust: 0.1
url:http://support.apple.com/kb/ht201222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1857
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1858
Trust: 0.1
sources:
            
            
            VULHUB: VHN-90668 // 
            
            
            
            VULMON: CVE-2016-1849 // 
            
            
            
            BID: 90690 // 
            
            
            
            JVNDB: JVNDB-2016-002843 // 
            
            
            
            PACKETSTORM: 137089 // 
            
            
            
            CNNVD: CNNVD-201605-504 // 
            
            
            
            NVD: CVE-2016-1849

CREDITS
Adham Ghrayeb
Trust: 0.3
sources:
            
            
            BID: 90690

SOURCES
db:VULHUBid:VHN-90668
db:VULMONid:CVE-2016-1849
db:BIDid:90690
db:JVNDBid:JVNDB-2016-002843
db:PACKETSTORMid:137089
db:CNNVDid:CNNVD-201605-504
db:NVDid:CVE-2016-1849

LAST UPDATE DATE
2025-04-13T21:30:36.516000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-90668date:2016-12-01T00:00:00
db:VULMONid:CVE-2016-1849date:2016-12-01T00:00:00
db:BIDid:90690date:2016-05-16T00:00:00
db:JVNDBid:JVNDB-2016-002843date:2016-05-24T00:00:00
db:CNNVDid:CNNVD-201605-504date:2016-05-25T00:00:00
db:NVDid:CVE-2016-1849date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-90668date:2016-05-20T00:00:00
db:VULMONid:CVE-2016-1849date:2016-05-20T00:00:00
db:BIDid:90690date:2016-05-16T00:00:00
db:JVNDBid:JVNDB-2016-002843date:2016-05-24T00:00:00
db:PACKETSTORMid:137089date:2016-05-17T16:10:15
db:CNNVDid:CNNVD-201605-504date:2016-05-20T00:00:00
db:NVDid:CVE-2016-1849date:2016-05-20T11:00:02.817