Information disclosure in Apple Mac OS X
CVE-2010-1406
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging, a related issue to CVE-2010-0660.
Vulnerability class: Information Disclosure
EPSS: 0.023 (81.2th percentile) — read the EPSS interpretation.
Affected products
- Apple Mac_os_x — versions 10.4.11, 10.4.7, 10.6.3
- Apple Mac_os_x_server — versions 10.4.11, 10.4.7, 10.6.3
- Apple Safari — versions 4.0, 4.0.2, 4.0.1
- Apple Webkit
- Microsoft Windows_7
- Microsoft Windows_vista
- Microsoft Windows_xp
- N/a — versions n/a
Weakness classification (CWE)
References
- product-security@apple.com (vendor-advisory, x_refsource_MANDRIVA)
- product-security@apple.com (vdb-entry, x_refsource_VUPEN)
- product-security@apple.com (x_refsource_SECUNIA, third-party-advisory)
- product-security@apple.com (x_refsource_UBUNTU, vendor-advisory)
- product-security@apple.com (x_refsource_SECUNIA, third-party-advisory)
- product-security@apple.com (vdb-entry, x_refsource_VUPEN)
- product-security@apple.com (x_refsource_CONFIRM)
- product-security@apple.com (vendor-advisory, x_refsource_APPLE, Patch, Vendor Advisory)
- product-security@apple.com (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- product-security@apple.com (Patch, vdb-entry, x_refsource_VUPEN, Vendor Advisory)