What’s Vulnerable › Vulnerabilities

CVE-2016-4763

• Severity: medium (CVSS 6.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-09-25 · updated 2026-06-17
• Weakness: CWE-310

Description

WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected products

• Apple Iphone Os: through 9.3.5
• Apple iTunes for Windows: through 12.4.3
• Apple Safari: through 9.1.3

References

• http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
• http://www.securityfocus.com/bid/93066
• http://www.securitytracker.com/id/1036854
• https://support.apple.com/HT207143
• https://support.apple.com/HT207157
• https://support.apple.com/HT207158
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
• http://www.securityfocus.com/bid/93066

Get alerted when CVE-2016-4763 or the next vulnerability affects your stack