CVE-2016-1849

low-risk
Published 2016-05-20

The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (2)

Affected Vendors

Apple

References (10)

Vendor Advisory http://lists.apple.com/archives/security-announce/2016/May/msg00002.html
Vendor Advisory http://lists.apple.com/archives/security-announce/2016/May/msg00005.html
http://www.securitytracker.com/id/1035888
Vendor Advisory https://support.apple.com/HT206565
Vendor Advisory https://support.apple.com/HT206568
Vendor Advisory http://lists.apple.com/archives/security-announce/2016/May/msg00002.html
Vendor Advisory http://lists.apple.com/archives/security-announce/2016/May/msg00005.html
http://www.securitytracker.com/id/1035888
Vendor Advisory https://support.apple.com/HT206565
Vendor Advisory https://support.apple.com/HT206568
20
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 7/34 · Low