About the security content of Safari 9.1.2 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2016-4651n/a: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CVE-2016-4622n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4623n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4624n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4591n/a: Improper Access Control
• CVE-2016-4583n/a: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• CVE-2016-4584n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4590WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site
• CVE-2016-4592WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted web site
• CVE-2016-4585n/a: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CVE-2016-4586WebKit in Apple Safari before 9.1.2 and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
• CVE-2016-4589n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer

Source and provenance

Original title: About the security content of Safari 9.1.2 - Apple Support. Captured 17 Oct 2026, 14:11 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.