CVE-2015-1067
Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.6%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1637.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 19.63% probability · 97th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- apple/mac os x · apple/tvos · apple/iphone os
- Source
- product-security@apple.com
EPSS 19.6% since 4 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Mar/msg00001.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.htmlVendor Advisory
- http://www.securityfocus.com/bid/73009
- http://www.securitytracker.com/id/1031829Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1031830Third Party Advisory, VDB Entry
- https://freakattack.com/Exploit
- https://support.apple.com/HT204413Vendor Advisory
- https://support.apple.com/HT204423Vendor Advisory
- https://support.apple.com/HT204426Vendor Advisory
- https://support.apple.com/HT204659Vendor Advisory
- https://support.apple.com/kb/HT204870
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Mar/msg00001.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.htmlVendor Advisory
- http://www.securityfocus.com/bid/73009
- http://www.securitytracker.com/id/1031829Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1031830Third Party Advisory, VDB Entry
- https://freakattack.com/Exploit
- https://support.apple.com/HT204413Vendor Advisory
- https://support.apple.com/HT204423Vendor Advisory
- https://support.apple.com/HT204426Vendor Advisory
- https://support.apple.com/HT204659Vendor Advisory
- https://support.apple.com/kb/HT204870
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.