CVE-2012-0641

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

CFNetwork in Apple iOS before 5.1 does not properly construct request headers during parsing of URLs, which allows remote attackers to obtain sensitive information via a malformed URL, a different vulnerability than CVE-2011-3447.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.htmlMailing List, Vendor Advisory
http://secunia.com/advisories/48288Third Party Advisory
http://www.securitytracker.com/id?1026774Third Party Advisory, VDB Entry
http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.htmlMailing List, Vendor Advisory
http://secunia.com/advisories/48288Third Party Advisory
http://www.securitytracker.com/id?1026774Third Party Advisory, VDB Entry

Timeline

Published: Mar 8, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-06429.3Integer underflow in Apple iOS before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (device crash) via CVE-2012-06439.3The kernel in Apple iOS before 5.1 does not properly handle debug system calls, which allows remote attackers to bypass sandbox restrictions CVE-2012-06446.9Race condition in the Passcode Lock feature in Apple iOS before 5.1 allows physically proximate attackers to bypass intended passcode requir CVE-2012-06451.2Siri in Apple iOS before 5.1 does not properly restrict the ability of Mail.app to handle voice commands, which allows physically proximate CVE-2012-06469.3Format string vulnerability in VPN in Apple iOS before 5.1 allows remote attackers to execute arbitrary code via a crafted racoon configurat CVE-2012-06475.0WebKit in Apple Safari before 5.1.4 does not properly handle redirects in conjunction with HTTP authentication, which might allow remote web CVE-2012-06487.6WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo CVE-2012-06496.9Race condition in the initialization routine in blued in Bluetooth in Apple Mac OS X before 10.7.4 allows local users to gain privileges via CVE-2012-06507.5Buffer overflow in the DirectoryService Proxy in DirectoryService in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitr CVE-2012-06515.0The directory server in Directory Service in Apple Mac OS X 10.6.8 allows remote attackers to obtain sensitive information from process memo CVE-2012-06524.9Login Window in Apple Mac OS X 10.7.3, when Legacy File Vault or networked home directories are enabled, does not properly restrict what is CVE-2012-06546.8libsecurity in Apple Mac OS X before 10.7.4 accesses uninitialized memory locations during the processing of X.509 certificates, which allow