CVE-2014-4363
First published: Thu Sep 18 2014(Updated: )
Safari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms, which allows remote attackers to obtain sensitive information via (1) an http web site, (2) an https web site with an unacceptable X.509 certificate, or (3) an IFRAME element.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iPhone OS | >=7.0<=7.1.2 | |
| Apple Safari | >=6.0<=6.1.5 | |
| Apple Safari | >=7.0<=7.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
- http://secunia.com/advisories/61306
- http://support.apple.com/kb/HT6440
- http://support.apple.com/kb/HT6441
- http://www.securityfocus.com/bid/69882
- http://www.securityfocus.com/bid/69909
- http://www.securitytracker.com/id/1030866
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96075
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- vendor/apple
- canonical/apple iphone os
- version/apple iphone os/7.0
- version/apple iphone os/7.1.2
- canonical/apple safari
- version/apple safari/6.0
- version/apple safari/6.1.5
- version/apple safari/7.0
- version/apple safari/7.0.5