CVE-2015-5860: Infoleak
Published Sep 18, 2015
·Updated
The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private-browsing protection mechanism and track users via a crafted web site.
Affected Software
2 affected components
Apple iPhone OS<=8.4.1
Apple WatchOS=1.0
Event History
Sep 18, 2015
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-5860?
CVE-2015-5860 has a high severity rating as it allows attackers to bypass Safari's private browsing feature.
2
How do I fix CVE-2015-5860?
To fix CVE-2015-5860, update your Apple device to iOS version 9 or later.
3
What types of devices are affected by CVE-2015-5860?
CVE-2015-5860 affects devices running Apple iOS versions up to 8.4.1 and watchOS 1.0.
4
What is the impact of CVE-2015-5860 on user privacy?
CVE-2015-5860 can compromise user privacy by allowing remote attackers to track users during private browsing sessions.
5
When was CVE-2015-5860 disclosed?
CVE-2015-5860 was disclosed in September 2015.