CVE-2012-3742
iPhone OS < 6 - HTTPS Spoofing via Unicode Lock Indicator Character
Title source: llmDescription
Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock indicator, which allows remote attackers to spoof https connections by placing this character in the TITLE element of a web page.
References (4)
Core 4
Core References
Vendor Advisory vendor-advisory
x_refsource_apple
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5503
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/78708
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/85632
Scores
EPSS
0.0192
EPSS Percentile
77.7%
Details
CWE
CWE-264
Status
published
Products (40)
apple/iphone_os
1.0.0
apple/iphone_os
1.0.1
apple/iphone_os
1.0.2
apple/iphone_os
1.1.0
apple/iphone_os
1.1.1
apple/iphone_os
1.1.2
apple/iphone_os
1.1.3
apple/iphone_os
1.1.4
apple/iphone_os
1.1.5
apple/iphone_os
2.0
... and 30 more
Published
Sep 20, 2012
Tracked Since
Feb 18, 2026