JVN#79013771 Safari allows access from HTTP to HTTPS

Safari is a default web browser installed in Mac OS X and iPhone.
Safari contains a vulnerability that allows a remote attacker to access web page contents protected by SSL/TLS from an HTTP page in the same domain.

Impact

A remote attacker could obtain or change the web page contents protected by SSL/TLS from an HTTP page in the same domain.

Solution

Update the Software
Apply the latest updates provided by the vendor.

For more information, refer to the vendor’s website.

Products Affected

• Safari for Mac OS X (from Mac OS X v10.4 to Mac OS X v10.4.10)
• Safari 3.0.3 and earlier for Mac OS X, Windows XP / Vista
• Versions prior to iPhone v1.1.1
  For more information, refer to the vendor’s website.