XLAB ID: XLAB-15-001     

CVE ID: CVE-2015-3755     

Patch Status: Fixed

Vulnerability Details:
A domain with a port number in the Safari browser, if the colon (:) behind is the non digital, displayed the colon (:) before the domain name in the address bar , the default page rendering can be blank and be changed arbitrarily. The attacker can carefully construct a malicious phishing page, forged any domain in the address bar, and change the content of the page. In Iphone/Ipad, JavaScript create alerts and warnings of the source is forged, and the HTTPS in the address bar will be with a small lock icon, which makes users believe that the current domain is more credible.

Disclosure Timeline:

2015/5/8 Provide vulnerability detail to APPLE via product-security@apple.com
2015/5/8 APPLE automatic reply
2015/5/9 APPLE responded that they are verifying the proof of concept code
2015/8/11 APPLE advisory disclosed，CVE-2015-3755

Credit:
This vulnerability was discovered by:   xisigr