CVE-2015-5824

The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate change, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Score
CVSS 2.0 4.3 Medium
Status
Modified - product-security@apple.com
Published
2015-09-18
Last modified
2024-08-06
Weaknesses
CWE-310

Affected products

References

 
 
© AVABIS GmbH privacypolicy about