CVE-2016-4655: Apple iOS Information Disclosure Vulnerability

Medium severity · published Aug 25, 2016

CVE-2016-4655

Apple iOS Information Disclosure Vulnerability

In wildKEV

5.5

CVSS

33.4%

EPSS

Yes

On KEV

Description

The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)33.4% · higher than 98% of CVEs

Exploited in the wildYes

CISA KEVListed May 24, 2022

Federal remediation dueJun 14, 2022

Ransomware campaign useNot known

Affected products

Which versions

iOS · Apple

before 9.3.5; 10.0 · source: NVD, KEV

Affected product

iOS

Apple

All iOS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-4655

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-4655

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

vendor-advisory

http://lists.apple.com/archives/security-announce/2016/Sep/msg00005.html

x_refsource_MISC

https://blog.lookout.com/blog/2016/08/25/trident-pegasus/

exploit

https://www.exploit-db.com/exploits/44836/

vdb-entry

http://www.securityfocus.com/bid/92651

x_refsource_CONFIRM

https://support.apple.com/HT207107

vendor-advisory

http://lists.apple.com/archives/security-announce/2016/Aug/msg00000.html