Unscored CVE-2016-1782 EUVD-2016-2877GHSA-q6q9-w26g-c8vj

WebKit in Apple iOS before 9.3 and Safari before 9.1 does not properly restrict redirects that specify a TCP port number, which allows remo…

Published Mar 24, 2016 · Updated Aug 5, 2024 · Assigned by apple

Package: qtwebkit-opensource-src Package: qtwebkit-source Package: webkitgtk Ecosystem: Ubuntu

Description

WebKit in Apple iOS before 9.3 and Safari before 9.1 does not properly restrict redirects that specify a TCP port number, which allows remote attackers to bypass intended port restrictions via a crafted web site.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	webkitgtk +2	No fix yet	—

References

APPLE-SA-2016-03-21-6 vendor-advisory
1035353 vdb-entry
APPLE-SA-2016-03-21-1 vendor-advisory
20160331 WebKitGTK+ Security Advisory WSA-2016-0003 mailing-list
https://support.apple.com/HT206171
https://support.apple.com/HT206166