CVE-2015-7094

Loading...

General

Score:2.6/10.0
Severity:Low
Category:Input Validation Error

Impact Metrics

Confidentiality:None
Integrity:Partial
Availability:None

Exploitability Metrics

Access Vector:Network
Access Complexity:High
Authentication:None

Relative vulnerabilities

CVE-2011-2895, CVE-2012-0876, CVE-2012-1147, CVE-2012-1148, CVE-2015-3807, CVE-2015-5333, CVE-2015-5334, CVE-2015-6908, CVE-2015-7001, CVE-2015-7037, CVE-2015-7038, CVE-2015-7039, CVE-2015-7040, CVE-2015-7041, CVE-2015-7042, CVE-2015-7043, CVE-2015-7044, CVE-2015-7045, CVE-2015-7046, CVE-2015-7047, CVE-2015-7048, CVE-2015-7050, CVE-2015-7051, CVE-2015-7052, CVE-2015-7053, CVE-2015-7054, CVE-2015-7055, CVE-2015-7058, CVE-2015-7059, CVE-2015-7060, CVE-2015-7061, CVE-2015-7062, CVE-2015-7063, CVE-2015-7064, CVE-2015-7065, CVE-2015-7066, CVE-2015-7067, CVE-2015-7068, CVE-2015-7069, CVE-2015-7070, CVE-2015-7071, CVE-2015-7072, CVE-2015-7073, CVE-2015-7074, CVE-2015-7075, CVE-2015-7076, CVE-2015-7077, CVE-2015-7078, CVE-2015-7079, CVE-2015-7080, CVE-2015-7081, CVE-2015-7083, CVE-2015-7084, CVE-2015-7093, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, CVE-2015-7103, CVE-2015-7105, CVE-2015-7106, CVE-2015-7107, CVE-2015-7108, CVE-2015-7109, CVE-2015-7110, CVE-2015-7111, CVE-2015-7112, CVE-2015-7113, CVE-2015-7803, CVE-2015-7804

Published on 11/12/15 - Updated on 13/09/17

Description

CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.

Category: Input Validation Error

CWE-20 (Input Validation)
The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

Security Notices

US National Vulnerability DatabaseCVE-2015-7094
Agence Nationale de la Sécurité des Systèmes d'Information CERTFR-2015-AVI-532, CERTFR-2015-AVI-534
Renater 2015/VULN282, 2015/VULN284

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
appleiphone_os
applemac_os_x

Share this vulnerability with:

Twitter Facebook LinkedIn Mail