CVE-2014-4363
First published: Thu Sep 18 2014(Updated: )
Safari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms, which allows remote attackers to obtain sensitive information via (1) an http web site, (2) an https web site with an unacceptable X.509 certificate, or (3) an IFRAME element.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| iStyle @cosme iPhone OS | >=7.0<=7.1.2 | |
| Apple Mobile Safari | >=6.0<=6.1.5 | |
| Apple Mobile Safari | >=7.0<=7.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
- http://secunia.com/advisories/61306
- http://support.apple.com/kb/HT6440
- http://support.apple.com/kb/HT6441
- http://www.securityfocus.com/bid/69882
- http://www.securityfocus.com/bid/69909
- http://www.securitytracker.com/id/1030866
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96075
Frequently Asked Questions
What is the severity of CVE-2014-4363?
CVE-2014-4363 has a medium severity rating, as it involves the exposure of sensitive user information.
How do I fix CVE-2014-4363?
To fix CVE-2014-4363, users should update their iOS to version 8 or higher, or use a secure password manager.
What versions are affected by CVE-2014-4363?
CVE-2014-4363 affects Safari versions prior to 7.1.5 and iOS versions prior to 8.
What are the potential risks of CVE-2014-4363?
The risks of CVE-2014-4363 include unauthorized access to sensitive information through insecure password autofill.
Is CVE-2014-4363 still a threat?
CVE-2014-4363 is less of a threat now, as it primarily affects older versions of iOS and Safari that are no longer widely used.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/istyle @cosme iphone os
- version/istyle @cosme iphone os/7.0
- version/istyle @cosme iphone os/7.1.2
- canonical/apple mobile safari
- version/apple mobile safari/6.0
- version/apple mobile safari/6.1.5
- version/apple mobile safari/7.0
- version/apple mobile safari/7.0.5