VulnerabilityModified

CVE-2016-1842

MapKit in Apple iOS before 9.3.2, OS X before 10.11.5, and watchOS before 2.2.1 does not use HTTPS for shared links, which allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.

HIGH 7.5EPSS 2.27%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 2.27% probability · 82th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: apple/iphone os · apple/mac os x · apple/watchos
Source: product-security@apple.com

References

http://lists.apple.com/archives/security-announce/2016/May/msg00002.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/May/msg00003.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/May/msg00004.htmlMailing List, Vendor Advisory
http://www.securitytracker.com/id/1035890Third Party Advisory, VDB Entry
https://support.apple.com/HT206566Vendor Advisory
https://support.apple.com/HT206567Vendor Advisory
https://support.apple.com/HT206568Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/May/msg00002.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/May/msg00003.htmlMailing List, Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/May/msg00004.htmlMailing List, Vendor Advisory
http://www.securitytracker.com/id/1035890Third Party Advisory, VDB Entry
https://support.apple.com/HT206566Vendor Advisory
https://support.apple.com/HT206567Vendor Advisory
https://support.apple.com/HT206568Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.