Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2016-4591: webkit2gtk may let attackers read local files
CVE-2016-4591 · published 10 years ago
Summary
The web rendering library webkit2gtk on Debian can mishandle certain data, allowing a remote attacker to access files on the server's own filesystem. This could expose sensitive information or enable further attacks. Upgrade to the latest webkit2gtk package or apply the vendor's security patch as soon as possible.
What to do
- Update debian webkit2gtk to version 2.12.4-1.
- Update canonical webkit2gtk to version 2.12.5-0ubuntu0.16.04.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | webkit2gtk |
< 2.12.4-1 Fix: upgrade to 2.12.4-1
|
| Debian:13 | debian | webkit2gtk |
< 2.12.4-1 Fix: upgrade to 2.12.4-1
|
| Debian:14 | debian | webkit2gtk |
< 2.12.4-1 Fix: upgrade to 2.12.4-1
|
| – | apple | webkit |
All versions
cpe:2.3:a:apple:webkit:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | webkit2gtk |
< 2.12.5-0ubuntu0.16.04.1 Fix: upgrade to 2.12.5-0ubuntu0.16.04.1
|
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
Original advisory text
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
References
- https://ubuntu.com/security/CVE-2016-4591 Third Party Advisory
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html Third Party Advisory
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html Third Party Advisory
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html Third Party Advisory
- https://support.apple.com/HT206900 Third Party Advisory
- https://support.apple.com/HT206902 Third Party Advisory
- https://webkitgtk.org/security/WSA-2016-0005.html Third Party Advisory
- https://ubuntu.com/security/notices/USN-3079-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2016-4591 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2016-4591 Vendor Advisory
- http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Dis... Third Party Advisory VDB Entry
- http://www.securityfocus.com/archive/1/539295/100/0/threaded Third Party Advisory VDB Entry
- http://www.securityfocus.com/bid/91830 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1036343 Third Party Advisory VDB Entry
- https://support.apple.com/HT206905 Third Party Advisory
Severity
7.5
High
Type
CWE-284Improper Access Control
Timeline
Published21 Jul 2016
Updated25 Oct 2026
First seen22 Sep 2026
Track software like this
Free during beta