CVE-2009-3455: Apple Safari

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected products

• Apple Safari: up to and including 4.0.2; version 0.8 only; version 0.9 only; version 1.0 only; version 1.0.0 only; version 1.0b1 only; …

Published 2009-09-29. Last modified 2026-06-16.