CVE-2015-5859

The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

Score

CVSS 2.0 4.3 Medium

Status

Modified - product-security@apple.com

Published

2015-11-22

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Iphone Os (Apple)
• Mac Os X (Apple)

References

• https://support.apple.com/HT205212
• https://support.apple.com/HT205267