Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2016-7578: Apple Safari, iOS, iCloud, iTunes, tvOS allow remote code execution
CVE-2016-7578 · published 9 years ago
Summary
Older versions of Apple’s Safari browser, iOS, iCloud, iTunes and tvOS can be tricked by a specially crafted web page to run unwanted code or crash the app. This could let an attacker take control of the device or cause it to stop working. Install the latest updates from Apple to protect your devices.
What to do
- Update canonical webkit2gtk to version 2.14.2-0ubuntu0.16.04.1.
- Update apple safari to version 10.0.1 or later.
- Update apple iphone_os to version 10.1 or later.
- Update apple icloud to version 6.0.1 or later.
- Update apple itunes to version 12.5.2 or later.
- Update apple tvos to version 10.0.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apple | safari |
< 10.0.1 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| – | apple | iphone_os |
< 10.1 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| – | apple | icloud |
< 6.0.1 cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:* |
| – | apple | itunes |
< 12.5.2 cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:* |
| – | apple | tvos |
< 10.0.1 cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | webkit2gtk |
< 2.14.2-0ubuntu0.16.04.1 Fix: upgrade to 2.14.2-0ubuntu0.16.04.1
|
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
Original advisory text
An issue was discovered in certain Apple products. iOS before 10.1 is affected. Safari before 10.0.1 is affected. iCloud before 6.0.1 is affected. iTunes before 12.5.2 is affected. tvOS before 10.0...
An issue was discovered in certain Apple products. iOS before 10.1 is affected. Safari before 10.0.1 is affected. iCloud before 6.0.1 is affected. iTunes before 12.5.2 is affected. tvOS before 10.0.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
References
- https://ubuntu.com/security/CVE-2016-7578 Third Party Advisory
- https://webkitgtk.org/security/WSA-2016-0006.html Third Party Advisory
- https://ubuntu.com/security/notices/USN-3166-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2016-7578 Third Party Advisory
- http://www.securityfocus.com/bid/93949 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1037139 Third Party Advisory VDB Entry
- https://support.apple.com/HT207270 Vendor Advisory
- https://support.apple.com/HT207271 Vendor Advisory
- https://support.apple.com/HT207272 Vendor Advisory
- https://support.apple.com/HT207273 Vendor Advisory
- https://support.apple.com/HT207274 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-119Buffer Overflow
Timeline
Published1 Dec 2016
Updated3 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta