CVE-2016-4585

Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.

• CWE-79

• http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.htmlMailing List, Vendor Advisory
• http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/539295/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/91830Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036343Third Party Advisory, VDB Entry
• https://support.apple.com/HT206900Vendor Advisory
• https://support.apple.com/HT206902Vendor Advisory
• https://support.apple.com/HT206905Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.htmlMailing List, Vendor Advisory
• http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/539295/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/91830Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036343Third Party Advisory, VDB Entry
• https://support.apple.com/HT206900Vendor Advisory
• https://support.apple.com/HT206902Vendor Advisory
• https://support.apple.com/HT206905Vendor Advisory

Published

Jul 22, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4579Libksba before 1.3.4 allows remote attackers to cause a deni…
• CVE-2016-4580The x25_negotiate_facilities function in net/x25/x25_facilit…
• CVE-2016-4581fs/pnode.c in the Linux kernel before 4.5.4 does not properl…
• CVE-2016-4582The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, t…
• CVE-2016-4583WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and t…
• CVE-2016-4584The WebKit Page Loading implementation in Apple iOS before 9…
• CVE-2016-4586WebKit in Apple Safari before 9.1.2 and tvOS before 9.2.2 al…
• CVE-2016-4587WebKit in Apple iOS before 9.3.3 and tvOS before 9.2.2 allow…
• CVE-2016-4588WebKit in Apple tvOS before 9.2.2 allows remote attackers to…
• CVE-2016-4589WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and t…
• CVE-2016-4590WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mis…
• CVE-2016-4591WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and t…