An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

The remote host is affected by the vulnerability described in GLSA-201706-15 (WebKitGTK+: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in WebKitGTK+. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attack can use multiple vectors to execute arbitrary code or       cause a denial of service condition.
  Workaround :

    There is no known workaround at this time.

Versions of Safari prior to 10.0.2 are affected by multiple vulnerabilities :

 - A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists because the Safari Reader feature does not properly validate certain input before returning it to users. This may allow a context-dependent attacker to execute arbitrary script code in a user's browser session within the trust relationship between their browser and any website.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. With a specially crafted web page, a context-dependent attacker can potentially disclose memory contents. 
 - An unspecified flaw exists that is triggered as certain input is not properly validated. With a specially crafted web page, a context-dependent attacker can potentially disclose certain user information.
 - A use-after-free error exists in the handling of 'RenderObject' objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the handling of 'HTMLLabelElement' objects. With a specially crafted web page, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists that is triggered when handling JavaScript prompts. With a specially crafted web page, a context-dependent attacker can disclose unspecified user information.
 - A flaw exists related to use of uninitialized memory. With a specially crafted web page, a context-dependent attacker can potentially disclose memory contents.
 - A flaw exists that is triggered when handling HTTP redirects. With specially crafted web contents, a context-dependent attacker can disclose unspecified user information.
 - An unspecified flaw exists that is triggered as certain input is not properly validated. With a specially crafted web page, a context-dependent attacker can corrupt memory and potentially execute arbitrary code.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 10.0.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted website, to corrupt memory and execute     arbitrary code. (CVE-2016-4692, CVE-2016-7635,     CVE-2016-7652)

  - Multiple information disclosure vulnerabilities exist     in WebKit due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these, by convincing a user to visit a specially crafted     website, to disclose memory contents. (CVE-2016-4743,     CVE-2016-7656)

  - An information disclosure vulnerability exists in WebKit     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7586)

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit these vulnerabilities, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7587, CVE-2016-7589:, CVE-2016-7610,     CVE-2016-7611, CVE-2016-7639, CVE-2016-7640,     CVE-2016-7641, CVE-2016-7642, CVE-2016-7645,     CVE-2016-7646, CVE-2016-7648, CVE-2016-7649,     CVE-2016-7654)

  - An information disclosure vulnerability exists in WebKit     due to improper handling of JavaScript prompts. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7592)

  - An information disclosure vulnerability exists in WebKit     due to the use of uninitialized memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose memory contents. (CVE-2016-7598)

  - An information disclosure vulnerability exists that is     triggered when handling HTTP redirections. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7599)

  - An information disclosure vulnerability exists in WebKit     due to improper validation of user-supplied input and     blob URLs. An unauthenticated, remote attacker can     exploit this, via a specially crafted blob URL, to     disclose user information. (CVE-2016-7623)

  - A remote code execution vulnerability exists in WebKit     due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a specially crafted website, to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-7632)

  - A cross-site scripting (XSS) vulnerability exists in     Safari Reader due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this, by convincing a user to follow a     specially crafted link, to execute arbitrary script code     in a user's browser session. (CVE-2016-7650)

The version of Apple iOS running on the mobile device is prior to 10.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accessibility
  - Accounts
  - Audio
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreText
  - Disk Images
  - Find My iPhone
  - FontParser
  - Graphics Driver
  - ICU
  - Image Capture
  - ImageIO
  - IOHIDFamily
  - IOKit
  - Kernel
  - libarchive
  - Local Authentication
  - Mail
  - Media Player
  - Power Management
  - Profiles
  - Safari Reader
  - Security
  - SpringBoard
  - syslog
  - WebKit

The version of Apple iTunes running on the remote host is prior to 12.5.4 It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted website, to corrupt memory and execute     arbitrary code. (CVE-2016-4692, CVE-2016-7635,     CVE-2016-7652)

  - Multiple information disclosure vulnerabilities exist     in WebKit due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these, by convincing a user to visit a specially crafted     website, to disclose memory contents. (CVE-2016-4743,     CVE-2016-7656)

  - An information disclosure vulnerability exists in WebKit     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7586)

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit these vulnerabilities, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7587, CVE-2016-7589:, CVE-2016-7610,     CVE-2016-7611, CVE-2016-7639, CVE-2016-7640,     CVE-2016-7641, CVE-2016-7642, CVE-2016-7645,     CVE-2016-7646, CVE-2016-7648, CVE-2016-7649,     CVE-2016-7654)

  - An information disclosure vulnerability exists in WebKit     due to improper handling of JavaScript prompts. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7592)

  - An information disclosure vulnerability exists in WebKit     due to the use of uninitialized memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose memory contents. (CVE-2016-7598)

  - An information disclosure vulnerability exists that is     triggered when handling HTTP redirections. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7599)

  - A remote code execution vulnerability exists in WebKit     due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a specially crafted website, to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-7632)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.5.4. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted website, to corrupt memory and execute     arbitrary code. (CVE-2016-4692, CVE-2016-7635,     CVE-2016-7652)

  - Multiple information disclosure vulnerabilities exist     in WebKit due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     these, by convincing a user to visit a specially crafted     website, to disclose memory contents. (CVE-2016-4743,     CVE-2016-7656)

  - An information disclosure vulnerability exists in WebKit     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7586)

  - Multiple remote code execution vulnerabilities exist in     WebKit due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit these vulnerabilities, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7587, CVE-2016-7589:, CVE-2016-7610,     CVE-2016-7611, CVE-2016-7639, CVE-2016-7640,     CVE-2016-7641, CVE-2016-7642, CVE-2016-7645,     CVE-2016-7646, CVE-2016-7648, CVE-2016-7649,     CVE-2016-7654)

  - An information disclosure vulnerability exists in WebKit     due to improper handling of JavaScript prompts. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to corrupt memory and execute arbitrary code.
    (CVE-2016-7592)

  - An information disclosure vulnerability exists in WebKit     due to the use of uninitialized memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose memory contents. (CVE-2016-7598)

  - An information disclosure vulnerability exists that is     triggered when handling HTTP redirections. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to disclose user information. (CVE-2016-7599)

  - A remote code execution vulnerability exists in WebKit     due to improper validation of user-supplied     input and improper state management. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a specially crafted website, to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-7632)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
100675	GLSA-201706-15 : WebKitGTK+: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
9864	Safari < 10.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
95919	macOS : Apple Safari < 10.0.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
95826	Apple iOS < 10.2 Multiple Vulnerabilities	Nessus	Mobile Devices	high
95825	Apple iTunes < 12.5.4 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
95824	Apple iTunes < 12.5.4 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high

Detections

Analytics

CVE-2016-7646

high

Tenable Plugins

high

medium

high

high

high

high