CVE

Id
68591  
CVE No.
CVE-2014-1296  
Status
Candidate  
Description
CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header"s value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.  
Phase
Assigned (20140108)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
659230 68591 CVE-2014-1296 APPLE:APPLE-SA-2014-04-22-1  View
659231 68591 CVE-2014-1296 URL:http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html  View
659232 68591 CVE-2014-1296 APPLE:APPLE-SA-2014-04-22-2  View
659233 68591 CVE-2014-1296 URL:http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html  View
659234 68591 CVE-2014-1296 APPLE:APPLE-SA-2014-04-22-3  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
13000 JVNDB-2014-001875 Apple Safari などで使用される WebKit における任意のコードを実行される脆弱性 Apple Safari などで使用される WebKit には、任意のコードを実行される、またはサービス運用妨害 (メモリ破損およびアプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2014-1304 68591 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001875.html  View