High severity7.5NVD Advisory· Published May 20, 2016· Updated May 6, 2026

CVE-2016-1842

Description

MapKit in Apple iOS before 9.3.2, OS X before 10.11.5, and watchOS before 2.2.1 does not use HTTPS for shared links, which allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.

Affected products

Apple Inc./Iphone Os
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Range: <=9.3.1
Apple Inc./Mac Os X
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Range: <=10.11.4
Apple Inc./watchOS
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Range: <=2.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

lists.apple.com/archives/security-announce/2016/May/msg00002.htmlnvdMailing ListVendor Advisory
lists.apple.com/archives/security-announce/2016/May/msg00003.htmlnvdMailing ListVendor Advisory
lists.apple.com/archives/security-announce/2016/May/msg00004.htmlnvdMailing ListVendor Advisory
www.securitytracker.com/id/1035890nvdThird Party AdvisoryVDB Entry
support.apple.com/HT206566nvdVendor Advisory
support.apple.com/HT206567nvdVendor Advisory
support.apple.com/HT206568nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000