CVE-2012-0641

Published: Mar 8, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

CFNetwork in Apple iOS before 5.1 does not properly construct request headers during parsing of URLs, which allows remote attackers to obtain sensitive information via a malformed URL, a different vulnerability than CVE-2011-3447.

Affected (1)

Products: Apple: Iphone Os

Apple

1 product

Iphone Os

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Before 5.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html

Source: product-security@apple.com

Mailing ListVendor Advisory

http://secunia.com/advisories/48288

Source: product-security@apple.com

Third Party Advisory

http://www.securitytracker.com/id?1026774

Source: product-security@apple.com

Third Party AdvisoryVDB Entry

http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

http://secunia.com/advisories/48288

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securitytracker.com/id?1026774

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.