About the security content of Safari 9.1.2

This document describes the security content of Safari 9.1.2.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.

Apple security documents reference vulnerabilities by CVE-ID when possible.

Safari 9.1.2

WebKit

Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.6

Impact: Visiting a maliciously crafted website may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed through improved memory handling.

CVE-2016-4589 : Tongbo Luo and Bo Qu of Palo Alto Networks

CVE-2016-4622 : Samuel Gross working with Trend Micro's Zero Day

CVE-2016-4623 : Apple

CVE-2016-4624 : Apple

CVE-2016-4586 : Apple

WebKit

Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.6

Impact: Visiting a malicious website may disclose image data from another website

Description: A timing issue existed in the processing of SVG. This issue was addressed through improved validation.

CVE-2016-4583 : Roeland Krak

WebKit

Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.6

Impact: Visiting a maliciously crafted webpage may lead to a system denial of service

Description: A memory consumption issue was addressed through improved memory handling.

CVE-2016-4592 : Mikhail

WebKit

Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.6

Impact: Visiting a maliciously crafted website may leak sensitive data

Description: A permissions issue existed in the handling of the location variable. This was addressed though additional ownership checks.

CVE-2016-4591 : ma.la of LINE Corporation

WebKit

Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.6

Impact: Visiting a malicious website may lead to user interface spoofing

Description: An origin inheritance issue existed in parsing of about: URLs. This was addressed through improved validation of security origins.

CVE-2016-4590 : xisigr of Tencent's Xuanwu Lab (www.tencent.com)

WebKit JavaScript Bindings

Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.6

Impact: Visiting a maliciously crafted website may lead to script execution in the context of a non-HTTP service

Description: A cross-protocol cross-site scripting (XPXSS) issue existed in Safari when submitting forms to non-HTTP services compatible with HTTP/0.9. This issue was addressed by disabling scripts and plugins on resources loaded over HTTP/0.9.

CVE-2016-4651 : Obscure

WebKit Page Loading

Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.6

Impact: A malicious website may exfiltrate data cross-origin

Description: A cross-site scripting issue existed in Safari URL redirection. This issue was addressed through improved URL validation on redirection.

CVE-2016-4585 : Takeshi Terada of Mitsui Bussan Secure Directions, Inc. (www.mbsd.jp)

WebKit Page Loading

Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11.6

Impact: Visiting a maliciously crafted website may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed through improved memory handling.

CVE-2016-4584 : Chris Vienneau