Base Score

HIGH8.8

CVE-2016-4657

WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

VectorNETWORK

Published Byproduct-security@apple.com

Published DateAug 25, 2016, 21:59

Weakness Type (CWE):CWE-787

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

REQUIRED

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH

References

http://lists.apple.com/archives/security-announce/2016/Aug/msg00000.html
http://www.securityfocus.com/bid/92653
http://www.securitytracker.com/id/1036694
https://blog.lookout.com/blog/2016/08/25/trident-pegasus/
https://support.apple.com/HT207107
https://www.exploit-db.com/exploits/44836/
https://www.youtube.com/watch?v=xkdPjbaLngE
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4657

Base Score

HIGH8.8

Weakness Type (CWE):CWE-787

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

REQUIRED

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH