CVE-2015-1129

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-04-10 · updated 2026-06-17
Weakness: CWE-310

Description

Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site.

Affected products

Apple Iphone Os: through 8.4.1
Apple Safari: through 6.2.4; 7.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5 (+11)

References

http://lists.apple.com/archives/security-announce/2015/Apr/msg00000.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html
http://www.securitytracker.com/id/1032047
https://support.apple.com/HT204658
https://support.apple.com/HT205212
http://lists.apple.com/archives/security-announce/2015/Apr/msg00000.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html
http://www.securitytracker.com/id/1032047
https://support.apple.com/HT204658
https://support.apple.com/HT205212

Get alerted when CVE-2015-1129 or the next vulnerability affects your stack