CVE-2010-1406: Infoleak
First published: Fri Jun 11 2010(Updated: )
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging, a related issue to CVE-2010-0660.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Mobile Safari | <=4.0.5 | |
| Apple Mobile Safari | =4.0 | |
| Apple Mobile Safari | =4.0.0b | |
| Apple Mobile Safari | =4.0.1 | |
| Apple Mobile Safari | =4.0.2 | |
| Apple Mobile Safari | =4.0.3 | |
| Apple Mobile Safari | =4.0.4 | |
| WebKit | ||
| Apple iOS and macOS | =10.5 | |
| Apple iOS and macOS | =10.5.0 | |
| Apple iOS and macOS | =10.5.1 | |
| Apple iOS and macOS | =10.5.2 | |
| Apple iOS and macOS | =10.5.3 | |
| Apple iOS and macOS | =10.5.4 | |
| Apple iOS and macOS | =10.5.5 | |
| Apple iOS and macOS | =10.5.6 | |
| Apple iOS and macOS | =10.5.7 | |
| Apple iOS and macOS | =10.5.8 | |
| Apple iOS and macOS | =10.6.0 | |
| Apple iOS and macOS | =10.6.1 | |
| Apple iOS and macOS | =10.6.2 | |
| Apple iOS and macOS | =10.6.3 | |
| Apple macOS Server | =10.5 | |
| Apple macOS Server | =10.5.0 | |
| Apple macOS Server | =10.5.1 | |
| Apple macOS Server | =10.5.2 | |
| Apple macOS Server | =10.5.3 | |
| Apple macOS Server | =10.5.4 | |
| Apple macOS Server | =10.5.5 | |
| Apple macOS Server | =10.5.6 | |
| Apple macOS Server | =10.5.7 | |
| Apple macOS Server | =10.5.8 | |
| Apple macOS Server | =10.6.0 | |
| Apple macOS Server | =10.6.1 | |
| Apple macOS Server | =10.6.2 | |
| Apple macOS Server | =10.6.3 | |
| Microsoft Windows 7 | ||
| Microsoft Windows Vista | ||
| Microsoft Windows XP | =sp2 | |
| Microsoft Windows XP | =sp3 | |
| Apple iOS and macOS | =10.4 | |
| Apple iOS and macOS | =10.4.0 | |
| Apple iOS and macOS | =10.4.1 | |
| Apple iOS and macOS | =10.4.2 | |
| Apple iOS and macOS | =10.4.3 | |
| Apple iOS and macOS | =10.4.4 | |
| Apple iOS and macOS | =10.4.5 | |
| Apple iOS and macOS | =10.4.6 | |
| Apple iOS and macOS | =10.4.7 | |
| Apple iOS and macOS | =10.4.8 | |
| Apple iOS and macOS | =10.4.9 | |
| Apple iOS and macOS | =10.4.10 | |
| Apple iOS and macOS | =10.4.11 | |
| Apple macOS Server | =10.4 | |
| Apple macOS Server | =10.4.0 | |
| Apple macOS Server | =10.4.1 | |
| Apple macOS Server | =10.4.2 | |
| Apple macOS Server | =10.4.3 | |
| Apple macOS Server | =10.4.4 | |
| Apple macOS Server | =10.4.5 | |
| Apple macOS Server | =10.4.6 | |
| Apple macOS Server | =10.4.7 | |
| Apple macOS Server | =10.4.8 | |
| Apple macOS Server | =10.4.9 | |
| Apple macOS Server | =10.4.10 | |
| Apple macOS Server | =10.4.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/40620
- http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
- http://securitytracker.com/id?1024067
- http://support.apple.com/kb/HT4196
- http://www.vupen.com/english/advisories/2010/1373
- http://secunia.com/advisories/40105
- http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
- http://support.apple.com/kb/HT4225
- http://www.vupen.com/english/advisories/2010/2722
- http://www.ubuntu.com/usn/USN-1006-1
- http://secunia.com/advisories/41856
- http://secunia.com/advisories/43068
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://www.vupen.com/english/advisories/2011/0212
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
- http://www.vupen.com/english/advisories/2011/0552
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7197
Frequently Asked Questions
What is the severity of CVE-2010-1406?
CVE-2010-1406 has a Medium severity rating due to the potential exposure of sensitive information.
How do I fix CVE-2010-1406?
To fix CVE-2010-1406, upgrade to a version of Apple Safari that is newer than 5.0 for Mac OS X and 4.1 for earlier versions.
Which versions of Apple Safari are affected by CVE-2010-1406?
CVE-2010-1406 affects versions of Apple Safari prior to 5.0 on Mac OS X 10.5 through 10.6 and prior to 4.1 on Mac OS X 10.4.
What type of vulnerability is CVE-2010-1406?
CVE-2010-1406 is a vulnerability related to the improper handling of the Referer header during HTTP redirects.
Who is affected by CVE-2010-1406?
Users of Apple Safari on Mac and Windows who are using versions before the specified patched releases are affected by CVE-2010-1406.
- collector/nvd-historical
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/apple mobile safari
- version/apple mobile safari/4.0.5
- version/apple mobile safari/4.0
- version/apple mobile safari/4.0.0b
- version/apple mobile safari/4.0.1
- version/apple mobile safari/4.0.2
- version/apple mobile safari/4.0.3
- version/apple mobile safari/4.0.4
- canonical/webkit
- canonical/apple ios and macos
- version/apple ios and macos/10.5
- version/apple ios and macos/10.5.0
- version/apple ios and macos/10.5.1
- version/apple ios and macos/10.5.2
- version/apple ios and macos/10.5.3
- version/apple ios and macos/10.5.4
- version/apple ios and macos/10.5.5
- version/apple ios and macos/10.5.6
- version/apple ios and macos/10.5.7
- version/apple ios and macos/10.5.8
- version/apple ios and macos/10.6.0
- version/apple ios and macos/10.6.1
- version/apple ios and macos/10.6.2
- version/apple ios and macos/10.6.3
- canonical/apple macos server
- version/apple macos server/10.5
- version/apple macos server/10.5.0
- version/apple macos server/10.5.1
- version/apple macos server/10.5.2
- version/apple macos server/10.5.3
- version/apple macos server/10.5.4
- version/apple macos server/10.5.5
- version/apple macos server/10.5.6
- version/apple macos server/10.5.7
- version/apple macos server/10.5.8
- version/apple macos server/10.6.0
- version/apple macos server/10.6.1
- version/apple macos server/10.6.2
- version/apple macos server/10.6.3
- vendor/microsoft
- canonical/microsoft windows 7
- canonical/microsoft windows vista
- canonical/microsoft windows xp
- version/microsoft windows xp/sp2
- version/microsoft windows xp/sp3
- version/apple ios and macos/10.4
- version/apple ios and macos/10.4.0
- version/apple ios and macos/10.4.1
- version/apple ios and macos/10.4.2
- version/apple ios and macos/10.4.3
- version/apple ios and macos/10.4.4
- version/apple ios and macos/10.4.5
- version/apple ios and macos/10.4.6
- version/apple ios and macos/10.4.7
- version/apple ios and macos/10.4.8
- version/apple ios and macos/10.4.9
- version/apple ios and macos/10.4.10
- version/apple ios and macos/10.4.11
- version/apple macos server/10.4
- version/apple macos server/10.4.0
- version/apple macos server/10.4.1
- version/apple macos server/10.4.2
- version/apple macos server/10.4.3
- version/apple macos server/10.4.4
- version/apple macos server/10.4.5
- version/apple macos server/10.4.6
- version/apple macos server/10.4.7
- version/apple macos server/10.4.8
- version/apple macos server/10.4.9
- version/apple macos server/10.4.10
- version/apple macos server/10.4.11