CVE-2009-1706

The Private Browsing feature in Apple Safari before 4.0 on Windows does not remove cookies from the alternate cookie store in unspecified circumstances upon (1) disabling of the feature or (2) exit of the application, which makes it easier for remote web servers to track users via a cookie.

Affected products

Safari

Apple Safari

≤ 3.2.3, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1, 3.1.1, 3.1.2, 3.2, 3.2.1, 3.2.2

Fix

Available

CVSS 2.0

5.0 MEDIUM

EPSS

1.4% (70th percentile)

Weakness

CWE-200

NVD status

Modified

Published

2009-06-10