CVE-2006-4390
CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as...
CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as trusted sites by using encryption without authentication, which can cause the lock icon in Safari to be displayed even when the site's identity cannot be trusted.
Exploit likelihood
What each source reports
NVD Score used
CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as trusted sites by using encryption without authentication, which can cause the lock icon in Safari to be displayed even when the site's identity cannot be trusted.
- Record
CVE-2006-4390- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as trusted sites by using encryption without authentication, which can cause the lock icon in Safari to be displayed even when the site's identity cannot be trusted.
- Record
CVE-2006-4390- Updated
- 2026-11-02
EUVDEUVD-2006-4378 No score
CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as trusted sites by using encryption without authentication, which can cause the lock icon in Safari to be displayed even when the site's identity cannot be trusted.
- Record
EUVD-2006-4378- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3x8-7pm6-7mwg No score
CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as...
CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as trusted sites by using encryption without authentication, which can cause the lock icon in Safari to be displayed even when the site's identity cannot be trusted.
- Record
GHSA-v3x8-7pm6-7mwg- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-4390 is a low vulnerability (CVSS 2.6) in Apple Mac Os X, published October 2, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. No source names a fixed version.
References
securityfocus.com/bid/20271
exchange.xforce.ibmcloud.com/vulnerabilities/29277
securitytracker.com/id?1016952
secunia.com/advisories/22187
vupen.com/english/advisories/2006/3852
lists.apple.com/archives/security-announce/2006/Sep/msg00002.html
osvdb.org/29267
nvd.nist.gov/vuln/detail/CVE-2006-4390
github.com/advisories/GHSA-v3x8-7pm6-7mwg