LowFix available
qtwebkit-opensource-src, qtwebkit-source and 2 more products — security advisory
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.
- Products
- qtwebkit-opensource-src, qtwebkit-source, webkit2gtk, webkitgtk
- Affected versions
- 2.10.3+dfsg1-1, 2.10.4+dfsg1-1, 2.10.5-1, 2.10.6-1, 2.10.6-1ubuntu1, 2.10.8-1ubuntu1, 2.10.9-1ubuntu1, 2.3.2-0ubuntu10, 2.3.2-0ubuntu11, 2.4.10-0ubuntu1, 2.4.11-0ubuntu0.1, 2.4.9-2ubuntu2, 2.8.5+dfsg1-3, 5.4.2+dfsg-1ubuntu2.1, 5.5.1+dfsg-2ubuntu1
- Fixed versions
- 2.12.5-0ubuntu0.16.04.1
- CVEs
- CVE-2016-4583
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:08 UTC · Revision 1
Source evidence
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.
osv:UBUNTU-CVE-2016-4583
webkit2gtk
Fixed versions: 2.12.5-0ubuntu0.16.04.1
qtwebkit-opensource-src
Fixed versions: Not specified
qtwebkit-source
Fixed versions: Not specified
webkitgtk
Fixed versions: Not specified
Complete source record
{
"id": "7103bf2eb8c91be8ea506a6e0015a63058de2dbd317aa7fca9770b3f334ebdff",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2016-4583",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2016-4583",
"summary": "WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.",
"evidence": "osv:UBUNTU-CVE-2016-4583",
"products": [
{
"name": {
"value": "webkit2gtk",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.12.5-0ubuntu0.16.04.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "2.8.5+dfsg1-3",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.3+dfsg1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.4+dfsg1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.6-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.6-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.8-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.9-1ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "qtwebkit-opensource-src",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+dfsg-1ubuntu2.1",
"evidence": "/affected/1/versions"
},
{
"value": "5.5.1+dfsg-2ubuntu1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "qtwebkit-source",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.2-0ubuntu10",
"evidence": "/affected/2/versions"
},
{
"value": "2.3.2-0ubuntu11",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "webkitgtk",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.9-2ubuntu2",
"evidence": "/affected/3/versions"
},
{
"value": "2.4.10-0ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "2.4.11-0ubuntu0.1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "low",
"structured": {
"id": "UBUNTU-CVE-2016-4583",
"aliases": [
"UBUNTU-CVE-2016-4583"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.12.5-0ubuntu0.16.04.1"
}
]
}
],
"package": {
"name": "webkit2gtk",
"purl": "pkg:deb/ubuntu/webkit2gtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.8.5+dfsg1-3",
"2.10.3+dfsg1-1",
"2.10.4+dfsg1-1",
"2.10.5-1",
"2.10.6-1",
"2.10.6-1ubuntu1",
"2.10.8-1ubuntu1",
"2.10.9-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4583.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-4.0",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "gir1.2-webkit2-4.0",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "libjavascriptcoregtk-4.0-18",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "libjavascriptcoregtk-4.0-bin",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "libwebkit2gtk-4.0-37",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
},
{
"binary_name": "libwebkit2gtk-4.0-37-gtk2",
"binary_version": "2.12.5-0ubuntu0.16.04.1"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-opensource-src",
"purl": "pkg:deb/ubuntu/qtwebkit-opensource-src?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"5.4.2+dfsg-1ubuntu2.1",
"5.5.1+dfsg-2ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4583.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqt5webkit5",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "libqt5webkit5-qmlwebkitplugin",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qml-module-qtwebkit",
"binary_version": "5.5.1+dfsg-2ubuntu1"
},
{
"binary_name": "qtwebkit5-doc-html",
"binary_version": "5.5.1+dfsg-2ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qtwebkit-source",
"purl": "pkg:deb/ubuntu/qtwebkit-source?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.3.2-0ubuntu10",
"2.3.2-0ubuntu11"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4583.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqtwebkit-qmlwebkitplugin",
"binary_version": "2.3.2-0ubuntu11"
},
{
"binary_name": "libqtwebkit4",
"binary_version": "2.3.2-0ubuntu11"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "webkitgtk",
"purl": "pkg:deb/ubuntu/webkitgtk?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.4.9-2ubuntu2",
"2.4.10-0ubuntu1",
"2.4.11-0ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4583.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gir1.2-javascriptcoregtk-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "gir1.2-webkit2-3.0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libjavascriptcoregtk-3.0-bin",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkit2gtk-3.0-25",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-1.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-0",
"binary_version": "2.4.11-0ubuntu0.1"
},
{
"binary_name": "libwebkitgtk-3.0-common",
"binary_version": "2.4.11-0ubuntu0.1"
}
]
}
}
],
"modified": "2026-10-08T12:49:51.354332944Z",
"provider": "osv",
"upstream": [
"CVE-2016-4583"
],
"references": [
"https://ubuntu.com/security/CVE-2016-4583",
"https://support.apple.com/HT206900",
"https://support.apple.com/HT206902",
"https://support.apple.com/HT206905",
"https://webkitgtk.org/security/WSA-2016-0005.html",
"https://ubuntu.com/security/notices/USN-3079-1",
"https://www.cve.org/CVERecord?id=CVE-2016-4583"
]
},
"related_cves": [
{
"value": "CVE-2016-4583",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 99470,
"published_at": "2016-07-21T00:00:00+00:00"
}