CVE-2015-1067 describes a vulnerability in Apple's Secure Transport, affecting iOS before 8.2, OS X through 10.10.2, and Apple TV before 7.1. This flaw allows remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers due to improper TLS state transition restrictions, a variant of the "FREAK" issue. With a CVSS score of 4.3 (medium severity), successful exploitation requires medium attack complexity and could lead to information integrity compromise (I:P). There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing. However, it garnered some community discussion and media coverage at the time of its disclosure.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 10.10.2CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | ||
<= 7.0.3CPE matchmatch criteria | cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | ||
<= 8.1.3CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.