CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web servers to overwrite cookies via unspecified vectors.
| Software | From | Fixed in |
|---|---|---|
| apple / mac_os_x | - | 10.11.0.x |
| apple / iphone_os | - | 9.0.2.x |