CVE-2012-3714: Infoleak
Published Sep 20, 2012
·Updated
The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill popover, which allows remote attackers to obtain the Me card from an Address Book via a crafted web site.
Affected Software
104 affected components
Safari
Safari<=6.0
Safari=1.0
Safari=1.0-beta
Safari=1.0-beta2
Safari=1.0.0
Safari=1.0.0b1
Safari=1.0.0b2
Safari=1.0.1
Safari=1.0.2
Safari=1.0.3
Safari=1.0.3-85.8
Safari=1.0.3-85.8.1
Safari=1.0b1
Safari=1.1
Safari=1.1.0
Safari=1.1.1
Safari=1.2
Safari=1.2.0
Safari=1.2.1
Safari=1.2.2
Safari=1.2.3
Safari=1.2.4
Safari=1.2.5
Safari=1.3
Safari=1.3.0
Safari=1.3.1
Safari=1.3.2
Safari=1.3.2-312.5
Safari=1.3.2-312.6
Safari=2
Safari=2.0
Safari=2.0.0
Safari=2.0.1
Safari=2.0.2
Safari=2.0.3
Safari=2.0.3-417.8
Safari=2.0.3-417.9
Safari=2.0.3-417.9.2
Safari=2.0.3-417.9.3
Safari=2.0.4
Safari=2.0.4
Safari=3
Safari=3.0
Safari=3.0.0
Safari=3.0.0
Safari=3.0.0b
Safari=3.0.0b
Safari=3.0.1
Safari=3.0.1
Safari=3.0.1-beta
Safari=3.0.1b
Safari=3.0.1b
Safari=3.0.2
Safari=3.0.2
Safari=3.0.2b
Safari=3.0.2b
Safari=3.0.3
Safari=3.0.3
Safari=3.0.3b
Safari=3.0.3b
Safari=3.0.4
Safari=3.0.4
Safari=3.0.4b
Safari=3.0.4b
Safari=3.1.0
Safari=3.1.0
Safari=3.1.0b
Safari=3.1.0b
Safari=3.1.1
Safari=3.1.1b
Safari=3.1.2
Safari=3.1.2b
Safari=3.2.0
Safari=3.2.0b
Safari=3.2.1
Safari=3.2.1b
Safari=3.2.2
Safari=3.2.2b
Safari=4.0
Safari=4.0-beta
Safari=4.0.0b
Safari=4.0.1
Safari=4.0.2
Safari=4.0.3
Safari=4.0.4
Safari=4.0.5
Safari=4.1
Safari=4.1.1
Safari=4.1.2
Safari=5.0
Safari=5.0.1
Safari=5.0.2
Safari=5.0.4
Safari=5.0.5
Safari=5.0.6
Safari=5.1
Safari=5.1.1
Safari=5.1.2
Safari=5.1.3
Safari=5.1.4
Safari=5.1.5
Safari=5.1.6
Safari=5.1.7
Event History
Sep 20, 2012
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-3714?
CVE-2012-3714 is rated as a high severity vulnerability due to its potential to expose sensitive information.
2
How do I fix CVE-2012-3714?
To fix CVE-2012-3714, users should update to Apple Safari version 6.0.1 or later.
3
What type of attack is possible with CVE-2012-3714?
CVE-2012-3714 allows remote attackers to craft malicious websites that can retrieve the user's Me card from their Address Book.
4
Which versions of Safari are affected by CVE-2012-3714?
CVE-2012-3714 affects all versions of Apple Safari before 6.0.1.
5
Is user data at risk with CVE-2012-3714?
Yes, user data is at risk as remote attackers can gain access to personal information stored in the Address Book.