CVE-2012-0585

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-03-08 · updated 2026-06-16
Weakness: CWE-264

Description

The Private Browsing feature in Safari in Apple iOS before 5.1 allows remote attackers to bypass intended privacy settings and insert history entries via JavaScript code that calls the (1) pushState or (2) replaceState method.

Affected products

Apple Iphone Os: before 5.1 — fixed in 5.1

How to fix

Upgrade to a fixed version: Apple Iphone Os 5.1. Check the vendor advisory for mitigations.

References

http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html
http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
http://osvdb.org/79964
http://secunia.com/advisories/48288
http://secunia.com/advisories/48377
http://www.securitytracker.com/id?1026774
https://exchange.xforce.ibmcloud.com/vulnerabilities/73871
http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html
http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html
http://osvdb.org/79964
http://secunia.com/advisories/48288
http://secunia.com/advisories/48377

Get alerted when CVE-2012-0585 or the next vulnerability affects your stack