Cross-site scripting (XSS) vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."

Versions of Safari prior to 10 are affected by multiple vulnerabilities in the following components :

 - Reader (CVE-2016-4618) 
 - Tabs (CVE-2016-4751) 
 - Webkit (CVE-2016-4611, CVE-2016-4728, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4733, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4758, CVE-2016-4759, CVE-2016-4760, CVE-2016-4762, CVE-2016-4763, CVE-2016-4765, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4769)

The version of iOS running on the mobile device is prior to 10.0, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-4698)
 - Assets (CVE-2016-4741)
 - Audio (CVE-2016-4702)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711, CVE-2016-4712)
 - FontParser (CVE-2016-4718)
 - GeoServices (CVE-2016-4719)
 - IDS - Connectivity (CVE-2016-4722)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - Keyboards (CVE-2016-4746)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxslt (CVE-2016-4738)
 - Mail (CVE-2016-4747)
 - Messages (CVE-2016-4740)
 - Printing UIKit (CVE-2016-4749)
 - S2 Camera (CVE-2016-4750)
 - Safari Reader (CVE-2016-4618)
 - Sandbox Profiles (CVE-2016-4620)
 - Security (CVE-2016-4753)
 - Springboard (CVE-2016-7759)
 - WebKit (CVE-2016-4728, CVE-2016-4758, CVE-2016-4611, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4759, CVE-2016-4762, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4760, CVE-2016-4733, CVE-2016-4765, CVE-2016-4763)

The version of Apple Safari installed on the remote Mac OS X or macOS host is prior to 10.0. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in WebKit that     allow an unauthenticated, remote attacker to cause a     denial of service condition or execute arbitrary code     via specially a crafted website. (CVE-2016-4611,     CVE-2016-4729, CVE-2016-4730, CVE-2016-4731,     CVE-2016-4734, CVE-2016-4735, CVE-2016-4737,     CVE-2016-4759, CVE-2016-4762, CVE-2016-4766,     CVE-2016-4767, CVE-2016-4768, CVE-2016-4769)

  - A cross-site scripting (XSS) vulnerability exists in the     Reader feature due to improper validation of     user-supplied input before returning it to users. An     unauthenticated, remote attacker can exploit this, by     convincing a user to follow a specially crafted link, to     execute arbitrary script code in a user's browser     session. (CVE-2016-4618)

  - A flaw exists in WebKit due to improper handling of     error prototypes. An unauthenticated, remote attacker     can exploit this, via a specially crafted website, to     execute arbitrary code. (CVE-2016-4728)

  - Multiple flaws exist in WebKit due to improper state     management. An unauthenticated, remote attacker     can exploit this, via a specially crafted website, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-4733, CVE-2016-4765)

  - An address bar spoofing vulnerability exists due to a     state management flaw related to sessions in tabs. An     unauthenticated, remote attacker can exploit this, via a     specially crafted website, to spoof an address in the     address bar. (CVE-2016-4751)

  - A flaw exists in WebKit due to improper handling of the     location variable. An unauthenticated, remote attacker     can exploit this, via a crafted website, to disclose     sensitive information. (CVE-2016-4758)

  - A flaw exists in WebKit that allows an unauthenticated,     remote attacker to conduct DNS rebinding attacks against     non-HTTP Safari sessions by leveraging HTTP/0.9 support.
    (CVE-2016-4760)

  - A flaw exists in WebKit in the WKWebView component due     to improper validation of X.509 certificates from HTTPS     servers. A man-in-the-middle attacker can exploit this,     via a crafted certificate, to disclose sensitive     information. (CVE-2016-4763)

ID	Name	Product	Family	Severity
9708	Safari < 10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
9619	Apple iOS < 10.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
93721	Mac OS X : Apple Safari < 10.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2016-4618

medium

Tenable Plugins

medium

critical

high