CVE-2015-6999 — Apple Iphone OS vulnerability

CWE-2543 documents3 sources
Severity
5.0MEDIUMNVD
EPSS
0.2%
top 55.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple Iphone OSApple IOS
Timeline
PublishedOct 23
Latest updateMay 17

Description

The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certificate.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDapple/iphone_os9.0.2
▶Appleapple/ios9.1

🔴Vulnerability Details

1
GHSA
GHSA-rp24-47cm-wf2p: The OCSP client in Apple iOS before 9↗2022-05-17
▶

📋Vendor Advisories

1
Apple
CVE-2015-6999: iOS 9.1↗
▶