CVE-2015-7094: Input Validation
Published Dec 11, 2015
·Updated
CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.
Affected Software
2 affected components
Apple iPhone OS<=9.1
Apple iOS and macOS<=10.11.1
Event History
Dec 11, 2015
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7094?
CVE-2015-7094 has a high severity rating as it allows man-in-the-middle attackers to bypass HSTS protection.
2
How do I fix CVE-2015-7094?
To fix CVE-2015-7094, upgrade to iOS 9.2 or later, or macOS 10.11.2 or later.
3
What versions are affected by CVE-2015-7094?
CVE-2015-7094 affects Apple iOS versions below 9.2 and OS X versions below 10.11.2.
4
What does CVE-2015-7094 allow an attacker to do?
CVE-2015-7094 allows attackers to perform man-in-the-middle attacks by bypassing the HSTS protection mechanism.
5
Is there a workaround for CVE-2015-7094?
There is no effective workaround for CVE-2015-7094; updating your operating system is necessary for protection.