PubSub in Apple Safari before 4.0.5 does not properly implement use of the Accept Cookies preference to block cookies, which makes it easier for remote web servers to track users by setting a cookie in a (1) RSS or (2) Atom feed.
lists.apple.com/archives/security-announce/2010/Mar/msg00000.html
osvdb.org/62937
support.apple.com/kb/HT4070
www.securityfocus.com/bid/38671
www.securityfocus.com/bid/38675
exchange.xforce.ibmcloud.com/vulnerabilities/56830
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7051