CVE-2015-5824: Medium severity apple ios, ipados, and watchos vulnerability
The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate change, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5824?
CVE-2015-5824 is classified as a significant vulnerability due to its potential to allow man-in-the-middle attacks.
How do I fix CVE-2015-5824?
To fix CVE-2015-5824, update affected Apple devices to the latest version of their operating systems that are no longer impacted.
Which devices are affected by CVE-2015-5824?
CVE-2015-5824 affects Apple iPhone OS versions up to 8.4.1, macOS Yosemite, and watchOS 1.0.
What type of attack does CVE-2015-5824 facilitate?
CVE-2015-5824 allows attackers to perform man-in-the-middle attacks by spoofing SSL servers.
What components does CVE-2015-5824 involve?
CVE-2015-5824 involves the NSURL implementation in the CFNetwork SSL component.