About the security content of Safari 10.1 - Apple Support

BlackTree keeps a versioned source snapshot and links it to relevant CVE reports. The publisher remains authoritative for product applicability, release details and installation guidance.

Read the official article ↗

Publishersupport.apple.com

Article IDNo stable ID in source URL

Verified snapshot17 Oct 2026, 08:14 UTC

Linked CVEs48

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

CVE-2016-9643n/a: Uncontrolled Resource Consumption
CVE-2016-9642JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file
CVE-2017-7071It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2492It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that triggers prototype mishandling
CVE-2017-2493It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted elements on a web site
CVE-2017-2491n/a: Use After Free
CVE-2017-2481It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2464It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2459It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2480It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site
CVE-2017-2444It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2453It allows remote attackers to spoof FaceTime prompts in the user interface via a crafted web site
CVE-2017-2475It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames on a web site
CVE-2017-2469It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2476It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2466It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2486It allows remote attackers to spoof the address bar via a crafted web site
CVE-2017-2470It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2463It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2460It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2465It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2447It allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted web site
CVE-2017-2479It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site
CVE-2017-2454It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2445It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects
CVE-2017-2471A use-after-free vulnerability allows remote attackers to execute arbitrary code via a crafted web site
CVE-2017-2468It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2457It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2419It allows remote attackers to bypass a Content Security Policy protection mechanism via unspecified vectors
CVE-2017-2442It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site
CVE-2017-2455It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2405It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2446It allows remote attackers to execute arbitrary code via a crafted web site that leverages the mishandling of strict mode functions
CVE-2017-2415It allows remote attackers to execute arbitrary code by leveraging an unspecified "type confusion."
CVE-2017-2385It allows local users to obtain access to locked keychain items via unspecified vectors
CVE-2017-2424It allows remote attackers to obtain sensitive information from process memory via a crafted web site
CVE-2017-2394It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2433It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2396It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2395It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-2392It allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app
CVE-2017-2386It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site
CVE-2017-2378It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during drag-and-drop actions
CVE-2017-2364It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site
CVE-2017-2389It allows remote attackers to spoof an HTTP authentication sheet or cause a denial of service via a crafted web site
CVE-2017-2377It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state
CVE-2017-2376It allows remote attackers to spoof the address bar by leveraging text input during the loading of a page
CVE-2017-2367It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site

Source and provenance

Original title: About the security content of Safari 10.1 - Apple Support. Captured 17 Oct 2026, 08:14 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.

Open the publisher's current version ↗