CVE-2010-1406: Infoleak
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging, a related issue to CVE-2010-0660.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1406?
CVE-2010-1406 has a Medium severity rating due to the potential exposure of sensitive information.
How do I fix CVE-2010-1406?
To fix CVE-2010-1406, upgrade to a version of Apple Safari that is newer than 5.0 for Mac OS X and 4.1 for earlier versions.
Which versions of Apple Safari are affected by CVE-2010-1406?
CVE-2010-1406 affects versions of Apple Safari prior to 5.0 on Mac OS X 10.5 through 10.6 and prior to 4.1 on Mac OS X 10.4.
What type of vulnerability is CVE-2010-1406?
CVE-2010-1406 is a vulnerability related to the improper handling of the Referer header during HTTP redirects.
Who is affected by CVE-2010-1406?
Users of Apple Safari on Mac and Windows who are using versions before the specified patched releases are affected by CVE-2010-1406.