PT-2017-4189 · Yandex · Yandex Browser

Published 2017-03-01 · Updated 2020-07-09 · CVE-2016-8507

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yandex Browser for iOS versions prior to 16.10.0.2357

Description The issue is related to improper restriction of processing of facetime:// URLs, which allows remote attackers to initiate a facetime call without the user's approval and obtain video and audio data from a device via a crafted web site. The vulnerability is associated with errors in checking URLs with the facetime:// scheme, allowing a remote attacker to initiate a video call without notifying the user.

Recommendations For Yandex Browser for iOS versions prior to 16.10.0.2357, update to version 16.10.0.2357 or later to resolve the issue. As a temporary workaround, consider avoiding the use of facetime:// URLs in the affected browser until a patch is applied. Restrict access to the facetime functionality to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-03577

CVE-2016-8507

Affected Products

Yandex Browser

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-8507 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8507 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03577 · Security Note
• https://yandex.com/blog/security-changelogs/fixed-in-version-16-10 · Vendor Advisory
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Note
• http://securityfocus.com/bid/96517 · Note