About the security content of iOS 9
This document describes the security content of iOS 9.
For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.
For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.
Where possible, CVE IDs are used to reference the vulnerabilities for further information.
To learn about other security updates, see Apple security updates.
iOS 9
Apple Pay
Available for: iPhone 6 and iPhone 6 Plus
Impact: Some cards may allow a terminal to retrieve limited recent transaction information when making a payment
Description: The transaction log functionality was enabled in certain configurations. This issue was addressed by removing the transaction log functionality. This issue did not affect iPad devices.
CVE-ID
CVE-2015-5916
AppleKeyStore
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local attacker may be able to reset failed passcode attempts with an iOS backup
Description: An issue existed in resetting failed passcode attempts with a backup of the iOS device. This was addressed through improved passcode failure logic.
CVE-ID
CVE-2015-5850 : an anonymous researcher
Application Store
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Clicking a malicious ITMS link may lead to a denial of service in an enterprise-signed application
Description: An issue existed with installation through ITMS links. This was addressed through additional installation verification.
CVE-ID
CVE-2015-5856 : Zhaofeng Chen, Hui Xue, and Tao (Lenx) Wei of FireEye, Inc.
Audio
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Playing a malicious audio file may lead to an unexpected application termination
Description: A memory corruption issue existed in the handling of audio files. This issue issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5862 : YoungJin Yoon of Information Security Lab. (Adv.: Prof. Taekyoung Kwon), Yonsei University, Seoul, Korea
Certificate Trust Policy
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Update to the certificate trust policy
Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/kb/HT204132.
CFNetwork
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A maliciously crafted URL may be able to bypass HTTP Strict Transport Security (HSTS) and leak sensitive data
Description: A URL parsing vulnerability existed in HSTS handling. This issue was addressed through improved URL parsing.
CVE-ID
CVE-2015-5858 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University
CFNetwork
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious website may be able to track users in Safari private browsing mode
Description: An issue existed in the handling of HSTS state in Safari private browsing mode. This issue was addressed through improved state handling.
CVE-ID
CVE-2015-5860 : Sam Greenhalgh of RadicalResearch Ltd
CFNetwork
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A person with physical access to an iOS device may read cache data from Apple apps
Description: Cache data was encrypted with a key protected only by the hardware UID. This issue was addressed by encrypting the cache data with a key protected by the hardware UID and the user's passcode.
CVE-ID
CVE-2015-5898 : Andreas Kurtz of NESO Security Labs
CFNetwork Cookies
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker in a privileged network position can track a user's activity
Description: A cross-domain cookie issue existed in the handling of top level domains. The issue was addressed through improved restrictions of cookie creation.
CVE-ID
CVE-2015-5885 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University
CFNetwork Cookies
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker may be able to create unintended cookies for a website
Description: WebKit would accept multiple cookies to be set in the document.cookie API. This issue was addressed through improved parsing.
CVE-ID
CVE-2015-3801 : Erling Ellingsen of Facebook
CFNetwork FTPProtocol
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Malicious FTP servers may be able to cause the client to perform reconnaissance on other hosts
Description: An issue existed in the handling of FTP packets when using the PASV command. This issue was resolved through improved validation.
CVE-ID
CVE-2015-5912 : Amit Klein
CFNetwork HTTPProtocol
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may be able to intercept network traffic
Description: An issue existed in the handling of HSTS preload list entries in Safari private browsing mode. This issue was addressed through improved state handling.
CVE-ID
CVE-2015-5859 : Rosario Giustolisi of University of Luxembourg
CFNetwork Proxies
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Connecting to a malicious web proxy may set malicious cookies for a website
Description: An issue existed in the handling of proxy connect responses. This issue was addressed by removing the set-cookie header while parsing the connect response.
CVE-ID
CVE-2015-5841 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University
CFNetwork SSL
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may intercept SSL/TLS connections
Description: A certificate validation issue existed in NSURL when a certificate changed. This issue was addressed through improved certificate validation.
CVE-ID
CVE-2015-5824 : Timothy J. Wood of The Omni Group
CFNetwork SSL
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker may be able to decrypt data protected by SSL
Description: There are known attacks on the confidentiality of RC4. An attacker could force the use of RC4, even if the server preferred better ciphers, by blocking TLS 1.0 and higher connections until CFNetwork tried SSL 3.0, which only allows RC4. This issue was addressed by removing the fallback to SSL 3.0.
CoreAnimation
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to leak sensitive user information
Description: Applications could access the screen framebuffer while they were in the background. This issue was addressed with improved access control on IOSurfaces.
CVE-ID
CVE-2015-5880 : Jin Han, Su Mon Kywe, Qiang Yan, Robert Deng, Debin Gao, Yingjiu Li of School of Information Systems Singapore Management University, Feng Bao and Jianying Zhou of Cryptography and Security Department Institute for Infocomm Research
CoreCrypto
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker may be able to determine a private key
Description: By observing many signing or decryption attempts, an attacker may have been able to determine the RSA private key. This issue was addressed using improved encryption algorithms.
CoreText
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation.
CVE-ID
CVE-2015-5874 : John Villamil (@day6reak), Yahoo Pentest Team
Data Detectors Engine
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted text file may lead to arbitrary code execution
Description: Memory corruption issues existed in the processing of text files. These issues were addressed through improved bounds checking.
CVE-ID
CVE-2015-5829 : M1x7e1 of Safeye Team (www.safeye.org)
Dev Tools
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in dyld. This was addressed through improved memory handling.
CVE-ID
CVE-2015-5876 : beist of grayhash
Disk Images
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in DiskImages. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5847 : Filippo Bigarella, Luca Todesco
dyld
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An application may be able to bypass code signing
Description: An issue existed with validation of the code signature of executables. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2015-5839 : @PanguTeam, TaiG Jailbreak Team
Game Center
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact : A malicious Game Center application may be able to access a player’s email address
Description: An issue existed in Game Center in the handling of a player's email. This issue was addressed through improved access restrictions.
CVE-ID
CVE-2015-5855 : Nasser Alnasser
ICU
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Multiple vulnerabilities in ICU
Description: Multiple vulnerabilities existed in ICU versions prior to 53.1.0. These issues were addressed by updating ICU to version 55.1.
CVE-ID
CVE-2014-8146 : Marc Deslauriers
CVE-2014-8147 : Marc Deslauriers
CVE-2015-5922 : Mark Brand of Google Project Zero
IOAcceleratorFamily
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to determine kernel memory layout
Description: An issue existed that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2015-5834 : Cererdlong of Alibaba Mobile Security Team
IOAcceleratorFamily
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in IOAcceleratorFamily. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5848 : Filippo Bigarella
IOHIDFamily
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in IOHIDFamily. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5867 : moony li of Trend Micro
IOKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5844 : Filippo Bigarella
CVE-2015-5845 : Filippo Bigarella
CVE-2015-5846 : Filippo Bigarella
IOMobileFrameBuffer
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in IOMobileFrameBuffer. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5843 : Filippo Bigarella
IOStorageFamily
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local attacker may be able to read kernel memory
Description: A memory initialization issue existed in the kernel. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5863 : Ilja van Sprundel of IOActive
iTunes Store
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: AppleID credentials may persist in the keychain after sign out
Description: An issue existed in keychain deletion. This issue was addressed through improved account cleanup.
CVE-ID
CVE-2015-5832 : Kasif Dekel from Check Point Software Technologies
JavaScriptCore
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: Memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
CVE-ID
CVE-2015-5791 : Apple
CVE-2015-5793 : Apple
CVE-2015-5814 : Apple
CVE-2015-5816 : Apple
CVE-2015-5822 : Mark S. Miller of Google
CVE-2015-5823 : Apple
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5868 : Cererdlong of Alibaba Mobile Security Team
CVE-2015-5896 : Maxime Villard of m00nbsd
CVE-2015-5903 : CESG
Entry updated December 21, 2016
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local attacker may control the value of stack cookies
Description: Multiple weaknesses existed in the generation of user space stack cookies. This was addressed through improved generation of stack cookies.
CVE-ID
CVE-2013-3951 : Stefan Esser
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local process can modify other processes without entitlement checks
Description: An issue existed where root processes using the processor_set_tasks API were allowed to retrieve the task ports of other processes. This issue was addressed through added entitlement checks.
CVE-ID
CVE-2015-5882 : Pedro Vilaça, working from original research by Ming-chieh Pan and Sung-ting Tsai; Jonathan Levin
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker may be able to launch denial of service attacks on targeted TCP connections without knowing the correct sequence number
Description: An issue existed in xnu's validation of TCP packet headers. This issues was addressed through improved TCP packet header validation.
CVE-ID
CVE-2015-5879 : Jonathan Looney
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker in a local LAN segment may disable IPv6 routing
Description: An insufficient validation issue existed in handling of IPv6 router advertisements that allowed an attacker to set the hop limit to an arbitrary value. This issue was addressed by enforcing a minimum hop limit.
CVE-ID
CVE-2015-5869 : Dennis Spindel Ljungmark
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to determine kernel memory layout
Description: An issue existed in XNU that led to the disclosure of kernel memory. This was addressed through improved initialization of kernel memory structures.
CVE-ID
CVE-2015-5842 : beist of grayhash
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to cause a system denial of service
Description: An issue existed in HFS drive mounting. This was addressed by additional validation checks.
CVE-ID
CVE-2015-5748 : Maxime Villard of m00nbsd
libc
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A remote attacker may be able to cause arbitrary code execution
Description: A memory corruption issue existed in the fflush function. This issue was addressed through improved memory handling.
CVE-ID
CVE-2014-8611 : Adrian Chadd and Alfred Perlstein of Norse Corporation
libpthread
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5899 : Lufeng Li of Qihoo 360 Vulcan Team
Mail
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker can send an email that appears to come from a contact in the recipient's address book
Description: An issue existed in the handling of the sender's address. This issue was addressed through improved validation.
CVE-ID
CVE-2015-5857 : Emre Saglam of salesforce.com
Multipeer Connectivity
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local attacker may be able to observe unprotected multipeer data
Description: An issue existed in convenience initializer handling in which encryption could be actively downgraded to a non-encrypted session. This issue was addressed by changing the convenience initializer to require encryption.
CVE-ID
CVE-2015-5851 : Alban Diquet (@nabla_c0d3) of Data Theorem
NetworkExtension
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to determine kernel memory layout
Description: An uninitialized memory issue in the kernel led to the disclosure of kernel memory content. This issue was addressed through memory initialization.
CVE-ID
CVE-2015-5831 : Maxime Villard of m00nbsd
OpenSSL
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Multiple vulnerabilities in OpenSSL
Description: Multiple vulnerabilities existed in OpenSSL versions prior to 0.9.8zg. These were addressed by updating OpenSSL to version 0.9.8zg.
CVE-ID
CVE-2015-0286
CVE-2015-0287
PluginKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious enterprise application can install extensions before the application has been trusted
Description: An issue existed in the validation of extensions during installation. This was addressed through improved app verification.
CVE-ID
CVE-2015-5837 : Zhaofeng Chen, Hui Xue, and Tao (Lenx) Wei of FireEye, Inc.
removefile
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing malicious data may lead to unexpected application termination
Description: An overflow fault existed in the checkint division routines. This issue was addressed with improved division routines.
CVE-ID
CVE-2015-5840 : an anonymous researcher
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to read Safari bookmarks on a locked iOS device without a passcode
Description: Safari bookmark data was encrypted with a key protected only by the hardware UID. This issue was addressed by encrypting the Safari bookmark data with a key protected by the hardware UID and the user's passcode.
CVE-ID
CVE-2015-7118 : Jonathan Zdziarski
Entry updated December 21, 2016
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a malicious website may lead to user interface spoofing
Description: An issue may have allowed a website to display content with a URL from a different website. This issue was addressed through improved URL handling.
CVE-ID
CVE-2015-5904 : Erling Ellingsen of Facebook, Łukasz Pilorz
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a malicious website may lead to user interface spoofing
Description: Navigating to a malicious website with a malformed window opener may have allowed the display of arbitrary URLs. This issue was addressed through improved handling of window openers.
CVE-ID
CVE-2015-5905 : Keita Haga of keitahaga.com
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Users may be tracked by malicious websites using client certificates
Description: An issue existed in Safari's client certificate matching for SSL authentication. This issue was addressed through improved matching of valid client certificates.
CVE-ID
CVE-2015-1129 : Stefan Kraus of fluid Operations AG, Sylvain Munaut of Whatever s.a.
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a malicious website may lead to user interface spoofing
Description: Multiple user interface inconsistencies may have allowed a malicious website to display an arbitrary URL. These issues were addressed through improved URL display logic.
CVE-ID
CVE-2015-5764 : Antonio Sanso (@asanso) of Adobe
CVE-2015-5765 : Ron Masas
CVE-2015-5767 : Krystian Kloskowski via Secunia, Masato Kinugawa
Safari Safe Browsing
iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Navigating to the IP address of a known malicious website may not trigger a security warning
Description: Safari's Safe Browsing feature did not warn users when visiting known malicious websites by their IP addresses. The issue was addressed through improved malicious site detection.
Rahul M of TagsDock
Security
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious app may be able to intercept communication between apps
Description: An issue existed that allowed a malicious app to intercept URL scheme communication between apps. This was mitigated by displaying a dialog when a URL scheme is used for the first time.
CVE-ID
CVE-2015-5835 : Teun van Run of FiftyTwoDegreesNorth B.V.; XiaoFeng Wang of Indiana University, Luyi Xing of Indiana University, Tongxin Li of Peking University, Tongxin Li of Peking University, Xiaolong Bai of Tsinghua University
Siri
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A person with physical access to an iOS device may be able to use Siri to read notifications of content that is set not to be displayed at the lock screen
Description: When a request was made to Siri, client side restrictions were not being checked by the server. This issue was addressed through improved restriction checking.
CVE-ID
CVE-2015-5892 : Robert S Mozayeni, Joshua Donvito
SpringBoard
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A person with physical access to an iOS device can reply to an audio message from the lock screen when message previews from the lock screen are disabled
Description: A lock screen issue allowed users to reply to audio messages when message previews were disabled. This issue was addressed through improved state management.
CVE-ID
CVE-2015-5861 : Daniel Miedema of Meridian Apps
SpringBoard
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to spoof another application's dialog windows
Description: An access issue existed with privileged API calls. This issue was addressed through additional restrictions.
CVE-ID
CVE-2015-5838 : Min (Spark) Zheng, Hui Xue, Tao (Lenx) Wei, John C.S. Lui
SQLite
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Multiple vulnerabilities in SQLite v3.8.5
Description: Multiple vulnerabilities existed in SQLite v3.8.5. These issues were addressed by updating SQLite to version 3.8.10.2.
CVE-ID
CVE-2015-3414
CVE-2015-3415
CVE-2015-3416
tidy
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: A memory corruption issue existed in Tidy. This issues was addressed through improved memory handling.
CVE-ID
CVE-2015-5522 : Fernando Muñoz of NULLGroup.com
CVE-2015-5523 : Fernando Muñoz of NULLGroup.com
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Object references may be leaked between isolated origins on custom events, message events and pop state events
Description: An object leak issue broke the isolation boundary between origins. This issue was addressed through improved isolation between origins.
CVE-ID
CVE-2015-5827 : Gildas
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: Memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
CVE-ID
CVE-2015-5789 : Apple
CVE-2015-5790 : Apple
CVE-2015-5792 : Apple
CVE-2015-5794 : Apple
CVE-2015-5795 : Apple
CVE-2015-5796 : Apple
CVE-2015-5797 : Apple
CVE-2015-5799 : Apple
CVE-2015-5800 : Apple
CVE-2015-5801 : Apple
CVE-2015-5802 : Apple
CVE-2015-5803 : Apple
CVE-2015-5804 : Apple
CVE-2015-5805
CVE-2015-5806 : Apple
CVE-2015-5807 : Apple
CVE-2015-5809 : Apple
CVE-2015-5810 : Apple
CVE-2015-5811 : Apple
CVE-2015-5812 : Apple
CVE-2015-5813 : Apple
CVE-2015-5817 : Apple
CVE-2015-5818 : Apple
CVE-2015-5819 : Apple
CVE-2015-5821 : Apple
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a malicious website may lead to unintended dialing
Description: An issue existed in handling of tel://, facetime://, and facetime-audio:// URLs. This issue was addressed through improved URL handling.
CVE-ID
CVE-2015-5820 : Andrei Neculaesei, Guillaume Ross
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: QuickType may learn the last character of a password in a filled-in web form
Description: An issue existed in WebKit's handling of password input context. This issue was addressed through improved input context handling.
CVE-ID
CVE-2015-5906 : Louis Romero of Google Inc.
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker in a privileged network position may be able to redirect to a malicious domain
Description: An issue existed in the handling of resource caches on sites with invalid certificates. The issue was addressed by rejecting the application cache of domains with invalid certificates.
CVE-ID
CVE-2015-5907 : Yaoqi Jia of National University of Singapore (NUS)
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious website may exfiltrate data cross-origin
Description: Safari allowed cross-origin stylesheets to be loaded with non-CSS MIME types which could be used for cross-origin data exfiltration. This issue was addressed by limiting MIME types for cross-origin stylesheets.
CVE-ID
CVE-2015-5826 : filedescriptor, Chris Evans
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: The Performance API may allow a malicious website to leak browsing history, network activity, and mouse movements
Description: WebKit's Performance API could have allowed a malicious website to leak browsing history, network activity, and mouse movements by measuring time. This issue was addressed by limiting time resolution.
CVE-ID
CVE-2015-5825 : Yossi Oren et al. of Columbia University's Network Security Lab
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: An issue existed with Content-Disposition headers containing type attachment. This issue was addressed by disallowing some functionality for type attachment pages.
CVE-ID
CVE-2015-5921 : Mickey Shkatov of the Intel(r) Advanced Threat Research Team, Daoyuan Wu of Singapore Management University, Rocky K. C. Chang of Hong Kong Polytechnic University, Łukasz Pilorz, superhei of www.knownsec.com
WebKit Canvas
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a malicious website may disclose image data from another website
Description: A cross-origin issue existed with "canvas" element images in WebKit. This was addressed through improved tracking of security origins.
CVE-ID
CVE-2015-5788 : Apple
WebKit Page Loading
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: WebSockets may bypass mixed content policy enforcement
Description: An insufficient policy enforcement issue allowed WebSockets to load mixed content. This issue was addressed by extending mixed content policy enforcement to WebSockets.
Kevin G. Jones of Higher Logic
FaceTime is not available in all countries or regions.
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.