Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-1853: Apple macOS before 10.11.5 leaks data via SSL

CVE-2016-1853 · published 10 years ago

Summary

Versions of Apple macOS prior to 10.11.5 contain a flaw that can let a remote attacker view sensitive information. The weakness is tied to outdated SSL version 2 support in the system's Tcl component. Update macOS to version 10.11.5 or later to close the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
apple	mac_os_x	<= 10.11.4 `cpe:2.3:o:apple:mac_os_x::::::::`

Original advisory text

Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support.

References

http://lists.apple.com/archives/security-announce/2016/May/msg00004.html Mailing List Vendor Advisory
http://www.securityfocus.com/bid/90696 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035895 Third Party Advisory VDB Entry
https://support.apple.com/HT206567 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published20 May 2016

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2016-1853 · NVD

Track software like this

Free during beta