CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2014-1266

The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.32

EPSS Ranking 96.7%

CVSS Severity

CVSS v3 Score 7.4

CVSS v2 Score 5.8

References

Products affected by CVE-2014-1266

Apple » Iphone Os » Version: 6.0

cpe:2.3:o:apple:iphone_os:6.0
Apple » Iphone Os » Version: 6.0.1

cpe:2.3:o:apple:iphone_os:6.0.1
Apple » Iphone Os » Version: 6.0.2

cpe:2.3:o:apple:iphone_os:6.0.2
Apple » Iphone Os » Version: 6.1

cpe:2.3:o:apple:iphone_os:6.1
Apple » Iphone Os » Version: 6.1.2

cpe:2.3:o:apple:iphone_os:6.1.2
Apple » Iphone Os » Version: 6.1.3

cpe:2.3:o:apple:iphone_os:6.1.3
Apple » Iphone Os » Version: 6.1.4

cpe:2.3:o:apple:iphone_os:6.1.4
Apple » Iphone Os » Version: 6.1.5

cpe:2.3:o:apple:iphone_os:6.1.5
Apple » Iphone Os » Version: 7.0

cpe:2.3:o:apple:iphone_os:7.0
Apple » Iphone Os » Version: 7.0.1

cpe:2.3:o:apple:iphone_os:7.0.1
Apple » Iphone Os » Version: 7.0.2

cpe:2.3:o:apple:iphone_os:7.0.2
Apple » Iphone Os » Version: 7.0.3

cpe:2.3:o:apple:iphone_os:7.0.3
Apple » Iphone Os » Version: 7.0.4

cpe:2.3:o:apple:iphone_os:7.0.4
Apple » Iphone Os » Version: 7.0.5

cpe:2.3:o:apple:iphone_os:7.0.5
Apple » Mac Os X » Version: 10.9

cpe:2.3:o:apple:mac_os_x:10.9
Apple » Mac Os X » Version: 10.9.1

cpe:2.3:o:apple:mac_os_x:10.9.1
Apple » Tvos » Version: 6.0

cpe:2.3:o:apple:tvos:6.0
Apple » Tvos » Version: 6.0.1

cpe:2.3:o:apple:tvos:6.0.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2014-1266

Products

Pricing

Contact Us