MediumFix available
qtwebkit-opensource-src, qtwebkit-source and 2 more products — security advisory
Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.
- Products
- qtwebkit-opensource-src, qtwebkit-source, webkit2gtk, webkitgtk
- Affected versions
- 2.10.3+dfsg1-1, 2.10.4+dfsg1-1, 2.10.5-1, 2.10.6-1, 2.10.6-1ubuntu1, 2.10.8-1ubuntu1, 2.10.9-1ubuntu1, 2.3.2-0ubuntu10, 2.3.2-0ubuntu11, 2.4.10-0ubuntu1, 2.4.11-0ubuntu0.1, 2.4.9-2ubuntu2, 2.8.5+dfsg1-3, 5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1
- Fixed versions
- 2.12.5-0ubuntu0.16.04.1
- CVEs
- CVE-2016-4585
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:07 UTC · Revision 1
Source evidence
Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.
osv:UBUNTU-CVE-2016-4585
webkit2gtk
Fixed versions: 2.12.5-0ubuntu0.16.04.1
qtwebkit-opensource-src
Fixed versions: Not specified
qtwebkit-source
Fixed versions: Not specified
webkitgtk
Fixed versions: Not specified
Complete source record
{
"id": "cafccc0d3b2428f118adde568332cea25ae082b8e71fab7065d26c991ca0957d",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2016-4585",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2016-4585",
"summary": "Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled by Safari.",
"evidence": "osv:UBUNTU-CVE-2016-4585",
"products": [
{
"name": {
"value": "webkit2gtk",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.12.5-0ubuntu0.16.04.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "2.8.5+dfsg1-3",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.3+dfsg1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.4+dfsg1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.6-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.6-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.8-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.9-1ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "qtwebkit-opensource-src",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+dfsg-1ubuntu2.1",
"evidence": "/affected/1/versions"
},
{
"value": "5.5.1+dfsg-2ubuntu1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "qtwebkit-source",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.2-0ubuntu10",
"evidence": "/affected/2/versions"
},
{
"value": "2.3.2-0ubuntu11",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.9-2ubuntu2",
"evidence": "/affected/3/versions"
},
{
"value": "2.4.10-0ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "2.4.11-0ubuntu0.1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2016-4585",
"aliases": [
"UBUNTU-CVE-2016-4585"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.12.5-0ubuntu0.16.04.1"
}
]
}
],
"package": {
"name": "webkit2gtk",
"purl": "pkg:deb/ubuntu/webkit2gtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.8.5+dfsg1-3",
"2.10.3+dfsg1-1",
"2.10.4+dfsg1-1",
"2.10.5-1",
"2.10.6-1",
"2.10.6-1ubuntu1",
"2.10.8-1ubuntu1",
"2.10.9-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4585.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-4.0",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "gir1.2-webkit2-4.0",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "libjavascriptcoregtk-4.0-18",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "libjavascriptcoregtk-4.0-bin",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "libwebkit2gtk-4.0-37",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "libwebkit2gtk-4.0-37-gtk2",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebkit-opensource-src?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"5.4.2+dfsg-1ubuntu2.1",
"5.5.1+dfsg-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4585.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webkit5",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "libqt5webkit5-qmlwebkitplugin",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qml-module-qtwebkit",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qtwebkit5-doc-html",
"binary_version": "5.5.1+dfsg-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-source",
"purl": "pkg:deb/ubuntu/qtwebkit-source?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.3.2-0ubuntu10",
"2.3.2-0ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4585.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqtwebkit-qmlwebkitplugin",
"binary_version": "2.3.2-0ubuntu11"
},
{
"binary_name": "libqtwebkit4",
"binary_version": "2.3.2-0ubuntu11"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.9-2ubuntu2",
"2.4.10-0ubuntu1",
"2.4.11-0ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4585.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
}
]
}
}
],
"modified": "2026-10-08T12:49:48.252669161Z",
"provider": "osv",
"upstream": [
"CVE-2016-4585"
],
"references": [
"https://ubuntu.com/security/CVE-2016-4585",
"https://support.apple.com/HT206900",
"https://support.apple.com/HT206902",
"https://support.apple.com/HT206905",
"https://webkitgtk.org/security/WSA-2016-0005.html",
"https://ubuntu.com/security/notices/USN-3079-1",
"https://www.cve.org/CVERecord?id=CVE-2016-4585"
]
},
"related_cves": [
{
"value": "CVE-2016-4585",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 99448,
"published_at": "2016-07-21T00:00:00+00:00"
}