Unscored CVE-2016-1779 EUVD-2016-2874GHSA-f55p-m2v7-m3pw

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location …

Published Mar 24, 2016 · Updated Aug 5, 2024 · Assigned by apple

Package: qtwebkit-opensource-src Package: qtwebkit-source Package: webkitgtk Ecosystem: Ubuntu

Description

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	webkitgtk +2	No fix yet	—

References

APPLE-SA-2016-03-21-6 vendor-advisory
1035353 vdb-entry
APPLE-SA-2016-03-21-1 vendor-advisory
20160331 WebKitGTK+ Security Advisory WSA-2016-0003 mailing-list
https://support.apple.com/HT206171
https://support.apple.com/HT206166