The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, which allows remote attackers to spoof the displayed URL, bypass the Same Origin Policy, and obtain sensitive cached information via a crafted web site.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP     responses with a 3xx (aka redirection) status code, which allows remote attackers to spoof the displayed     URL, bypass the Same Origin Policy, and obtain sensitive cached information via a crafted web site.
    (CVE-2016-1786)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Safari installed on the remote host is prior or equal to 9.0.3, and is affected by multiple vulnerabilities in the following components :

 - Libxml2 (2016-1762)
 - Safari (CVE-2009-2197)
 - Safari Downloads (CVE-2016-1771)
 - Safari Top Sites (CVE-2016-1772)
 - WebKit (CVE-2016-1778, CVE-2016-1779, CVE-2016-1781, CVE-2016-1782, CVE-2016-1783, CVE-2016-1784, CVE-2016-1785, CVE-2016-1786, CVE-2016-1864)
 - WebKit History (CVE-2016-1784)
 - WebKit Page Loading (CVE-2016-1785, CVE-2016-1786)

The remote host is running a version of iOS that is prior to version 9.3 and the following components contain vulnerabilities :

 - AppleUSBNetworking
 - FontParser
 - HTTPProtocol
 - IOHIDFamily
 - Kernel
 - LaunchServices
 - libxml2
 - Messages
 - Profiles
 - Security
 - TrueTypeScaler
 - WebKit
 - Wi-Fi

The mobile device is running a version of iOS prior to version 9.3. It is, therefore, affected by multiple vulnerabilities in the following components :

  - AppleUSBNetworking
  - FontParser
  - HTTPProtocol
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libxml2
  - Messages
  - Profiles
  - Security
  - TrueTypeScaler
  - WebKit
  - Wi-Fi

ID	Name	Product	Family	Type	Severity
263995	Linux Distros Unpatched Vulnerability : CVE-2016-1786	Nessus	Misc.	Local	medium
9396	Safari < 9.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		critical
9331	Apple iOS < 9.3 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices		high
90118	Apple iOS < 9.3 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	critical

Detections

Analytics

CVE-2016-1786

medium

Tenable Plugins

medium

critical

high

critical