About the security content of iOS 3.0 Software Update

This document describes the security content of iOS 3.0 Software Update.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates."

This article has been archived and is no longer updated by Apple.

iOS 3.0 Software Update

  • CoreGraphics

    CVE-ID: CVE-2008-3623

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution

    Description: A heap buffer overflow exists in the handling of color spaces within CoreGraphics. Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit: Apple.

  • CoreGraphics

    CVE-ID: CVE-2009-0145

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

    Description: Multiple memory corruption issues exist in CoreGraphics' handling of PDF files. Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issues through improved bounds and error checking.

  • CoreGraphics

    CVE-ID: CVE-2009-0146, CVE-2009-0147, CVE-2009-0165

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Viewing or downloading a PDF file containing a maliciously crafted JBIG2 stream may lead to an unexpected application termination or arbitrary code execution

    Description: Multiple heap buffer overflows exist in CoreGraphics' handling of PDF files containing JBIG2 streams. Viewing or downloading a PDF file containing a maliciously crafted JBIG2 stream may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Apple, Alin Rad Pop of Secunia Research, and Will Dormann of CERT/CC for reporting this issue.

  • CoreGraphics

    CVE-ID: CVE-2009-0155

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

    Description: An integer underflow in CoreGraphics' handling of PDF files may result in a heap buffer overflow. Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Barry K. Nathan for reporting this issue.

  • CoreGraphics

    CVE-ID: CVE-2009-1179

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

    Description: An integer overflow in CoreGraphics' handling of PDF files may result in a heap buffer overflow. Opening a PDF file containing a maliciously crafted JBIG2 stream may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Will Dormann of CERT/CC for reporting this issue.

  • CoreGraphics

    CVE-ID: CVE-2009-0946

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Multiple vulnerabilities in FreeType v2.3.8

    Description: Multiple integer overflows exist in FreeType v2.3.8, which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issues through improved bounds checking. Credit to Tavis Ormandy of the Google Security Team for reporting these issues.

  • Exchange

    CVE-ID: CVE-2009-0958

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Connecting to a malicious Exchange server may lead to the disclosure of sensitive information

    Description: Accepting an untrusted Exchange server certificate results in storing an exception on a per-hostname basis. On the next visit to an Exchange server contained in the exception list, its certificate is accepted with no prompt and validation. This may lead to the disclosure of credentials or application data. This update addresses the issue through improved handling of untrusted certificate exceptions. Credit to FD of Securus Global for reporting this issue.

  • ImageIO

    CVE-ID: CVE-2009-0040

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Processing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution

    Description: An uninitialized pointer issue exists in the handling of PNG images. Processing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through additional validation of PNG images. Credit to Tavis Ormandy of Google Security Team for reporting this issue.

  • International Components for Unicode

    CVE-ID: CVE-2009-0153

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Maliciously crafted content may bypass website filters and result in cross-site scripting

    Description: An implementation issue exists in ICU's handling of certain character encodings. Using ICU to convert invalid byte sequences to Unicode may result in over-consumption, where trailing bytes are considered part of the original character. This may be leveraged by an attacker to bypass filters on websites that attempt to mitigate cross-site scripting. This update addresses the issue through improved handling of invalid byte sequences. Credit to Chris Weber of Casaba Security for reporting this issue.

  • IPSec

    CVE-ID: CVE-2008-3651, CVE-2008-3652

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Multiple vulnerabilities in the racoon daemon may lead to a denial of service

    Description: Multiple memory leaks exist in the racoon daemon in ipsec-tools before 0.7.1, which may lead to a denial of service. This update addresses the issues through improved memory management.

  • libxml

    CVE-ID: CVE-2008-3281, CVE-2008-3529, CVE-2008-4409, CVE-2008-4225, CVE-2008-4226

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Multiple vulnerabilities in libxml2 version 2.6.16

    Description: Multiple vulnerabilities in libxml2 version 2.6.16, the most serious of which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by updating the libxml2 system library to version 2.7.3.

  • Mail

    CVE-ID: CVE-2009-0960

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Users do not have control over the loading of remote images in HTML messages

    Description: Mail does not provide a preference to turn off the automatic loading of remote images. Opening an HTML email containing a remote image will automatically request it. The server hosting a remote image can determine that the email was read, and the network address of the device. This update addresses the issue by adding a preference to turn off the automatic loading of remote images. Credit to Ronald C.F. Antony of Cubiculum Systems, Stefan Seiz of ERNI Electronics GmbH, Oskar Lissheim-Boethius of iPhone development house OLB Productions, Meyer Consulting, Oliver Quas, Christian Schmitz of MonkeybreadSoftware, Thomas Adams of TynTec, Aviv Raff of aviv.raffon.net, and Collin Mulliner of Fraunhofer SIT for reporting this issue.

  • Mail

    CVE-ID: CVE-2009-0961

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: An application that causes an alert to apear may initiate a phone call without user interaction

    Description: If an application causes an alert to apear while Mail's call approval dialog is shown, the call will be placed without user interaction. This update addresses the issue by not dismissing the call approval dialog when other alerts appear. Credit to Collin Mulliner of Fraunhofer SIT for reporting this issue.

  • MPEG-4 Video Codec

    CVE-ID: CVE-2009-0959

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Viewing a maliciously crafted MPEG-4 video file may lead to an unexpected device reset

    Description: An input validation issue exists in the handling of MPEG-4 video files. Viewing a maliciously crafted MPEG-4 video file may lead to an unexpected device reset. This update addresses the issue through improved handling of MPEG-4 video files. Credit to Si Brindley for reporting this issue.

  • Profiles

    CVE-ID: CVE-2009-1679

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Installing a configuration profile may weaken the passcode policy defined by Exchange ActiveSync

    Description: An issue in the handling of configuration profiles may allow a weaker passcode policy to overwrite the passcode policy already set via Exchange ActiveSync. This may allow a person with physical access to the device to bypass the passcode policy set via Exchange ActiveSync. This update addresses the issue through improved handling of configuration profiles.

  • Safari

    CVE-ID: CVE-2009-1680

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Clearing Safari's history via the Settings application does not prevent disclosure of the search history to a person with physical access to the device

    Description: Clearing Safari's history via the Settings application does not reset the search history. In this case, another person with physical access to the device may be able to view the search history. This update addresses the issue by removing the search history when Safari's history is cleared via the Settings application. Credit to Joshua Belsky for reporting this issue.

  • Safari

    CVE-ID: CVE-2009-1681

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Interacting with a maliciously crafted website may result in unexpected actions on other sites

    Description: A design issue exists in the same-origin policy mechanism used to limit interactions between websites. This policy allows websites to load pages from third-party websites into a subframe. This frame may be positioned to entice the user to click a particular element within the frame, an attack referred to as "clickjacking". A maliciously crafted website may be able to manipulate a user into taking an unexpected action, such as initiating a purchase. This update addresses the issue through adoption of the industry-standard 'X-Frame-Options' extension header, that allows individual web pages to opt out of being displayed within a subframe.

  • Telephony

    CVE-ID: CVE-2009-1683

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: A remote attacker may cause an unexpected device reset

    Description: A logic issue in the handling of ICMP echo request packets may cause an assertion to be triggered. By sending a maliciously crafted ICMP echo request packet, a remote attacker may be able to cause an unexpected device reset. This update addresses the issue by removing the assertion. Credit to Masaki Yoshida for reporting this issue.

  • WebKit

    CVE-ID: CVE-2008-7260

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue exists in WebKit's handling of invalid color strings in Cascading Style Sheets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved sanitization of color strings. Credit to Thomas Raffetseder of the International Secure Systems Lab for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-0945

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may lead to arbitrary code execution

    Description: A memory corruption issue exists in WebKit's handling of SVGList objects. Visiting a maliciously crafted website may lead to arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Nils working with TippingPoint's Zero Day Initiative for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1684

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may result in cross-site scripting

    Description: A cross-site scripting issue exists in the separation of JavaScript contexts. A maliciously crafted web page may use an event handler to execute a script in the security context of the next web page that is loaded in its window or frame. This update addresses the issue by ensuring that event handlers are not able to directly affect an in-progress page transition. Credit to Michal Zalewski of Google Inc. for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1685

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may result in cross-site scripting

    Description: A cross-site scripting issue exists in the separation of JavaScript contexts. By enticing a user to visit a maliciously crafted web page, the attacker may overwrite the 'document.implementation' of an embedded or parent document served from a different security zone. This update addresses the issue by ensuring that changes to 'document.implementation' do not affect other documents. Credit to Dean McNamee of Google Inc. for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1686

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may lead to arbitrary code execution

    Description: A type conversion issue exists in WebKit's JavaScript exception handling. When an attempt is made to assign the exception to a variable that is declared as a constant, an object is cast to an invalid type, causing memory corruption. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by ensuring that assignment in a const declaration writes to the variable object. Credit to Jesse Ruderman of Mozilla Corporation for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1687

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue exists in WebKit's JavaScript garbage collector implementation. If an allocation fails, a memory write to an offset of a NULL pointer may result, leading to an unexpected application termination or arbitrary code execution. This update addresses the issue by checking for allocation failure. Credit to SkyLined of Google Inc. for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1688, CVE-2009-1689

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may result in a cross-site scripting attack

    Description: Multiple issues in WebKit's handling of javascript objects may lead to a cross-site scripting attack. This update addresses the issues through improved handling of cross-site interaction with javascript objects. Credit to Adam Barth of UC Berkeley, and Collin Jackson of Stanford University for reporting these issues.

  • WebKit

    CVE-ID: CVE-2009-1690

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may result in an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue exists in WebKit's handling of recursion in certain DOM event handlers. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved memory management. Credit to SkyLined of Google Inc. for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1691

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may lead to cross-site scripting

    Description: A cross-site scripting issue in Safari allows a maliciously crafted website to alter standard JavaScript prototypes of websites served from a different domain. By enticing a user to visit a maliciously crafted web page, an attacker may be able to alter the execution of JavaScript served from other websites. This update addresses the issue through improved access controls on these prototypes.

  • WebKit

    CVE-ID: CVE-2009-1692

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may lead to an unexpected device reset

    Description: A memory consumption issue exists in the handling of HTMLSelectElement objects. Visiting a maliciously crafted webpage containing an HTMLSelectElement with a very large length attribute may lead to an unexpected device reset. This update addresses the issue through improved handling of HTMLSelectElement objects. Credit to Thierry Zoller of G-SEC (www.g-sec.lu) for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1693

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may disclose images from other sites

    Description: A cross-site image capture issue exists in WebKit. By using a canvas with an SVG image, a maliciously crafted website may load and capture an image from another website. This update addresses the issue by restricting the reading of canvases that have images loaded from other websites. Credit to Chris Evans of Google Inc. for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1694

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may disclose images from other sites

    Description: A cross-site image capture issue exists in WebKit. By using a canvas and a redirect, a maliciously crafted website may load and capture an image from another website. This update addresses the issue through improving the handling of redirects. Credit to Chris Evans of for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1695

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may result in a cross-site scripting attack

    Description: An issue in WebKit allows the contents of a frame to be accessed by an HTML document after a page transition has taken place. This may allow a maliciously crafted website to perform a cross-site scripting attack. This update addresses the issue through an improved domain check. Credit to Feng Qian of Google Inc. for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1696

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Websites may surreptitiously track users

    Description: Safari generates random numbers for JavaScript applications using a predictable algorithm. This could allow a website to track a particular Safari session without using cookies, hidden form elements, IP addresses, or other techniques. This update addresses the issue by using a better random number generator. Credit to Amit Klein of Trusteer for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1697

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may result in a cross-site scripting attack

    Description: A CRLF injection issue exists in the handling of XMLHttpRequest headers in WebKit. This may allow a malicious website to bypass the same-origin policy by issuing an XMLHttpRequest that does not contain a Host header. XMLHttpRequests without a Host header may reach other websites on the same server, and allow attacker-supplied JavaScript to interact with those sites. This update addresses the issue through improved handling of XMLHttpRequest headers. Credit to Per von Zweigbergk for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1698

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Viewing a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution

    Description: An uninitialized pointer issue exists in the handling of the CSS 'attr' function. Viewing a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through additional validation of CSS elements. Credit to Thierry Zoller working with TippingPoint's Zero Day Initiative, and Robert Swiecki of the Google Security Team for reporting this as a security issue.

  • WebKit

    CVE-ID: CVE-2009-1699

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may result in an information disclosure

    Description: An XML External Entity issue exists in WebKit's handling of XML. Visiting a maliciously crafted website may result in the website being able to read files from the user's system. This update addresses the issue by not loading external entities across origins. Credit to Chris Evans of Google Inc. for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1700

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may result in the disclosure of sensitive information

    Description: WebKit does not properly handle redirects when processing Extensible Stylesheet Language Transformations (XSLT). This allows a maliciously crafted website to retrieve XML content from pages on other websites, which could result in the disclosure of sensitive information. This update addresses the issue by ensuring that documents referenced in transformations are downloaded from the same domain as the transformation itself. Credit to Chris Evans of Google Inc. for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1701

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: A use-after-free issue exists in WebKit's handling of the JavaScript DOM. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of document elements. Credit to wushi & ling of team509 working with TippingPoint's Zero Day Initiative for reporting this issue.

  • WebKit

    CVE-ID: CVE-2009-1702

    Available for: iOS 1.0 through 2.2.1, iOS for iPod touch 1.1 through 2.2.1

    Impact: Visiting a malicious website may lead to a cross-site scripting attack

    Description: An issue in WebKit's handling of Location and History objects may result in a cross-site scripting attack when visiting a malicious website. This update addresses the issue through improved handling of Location and History objects. Credit to Adam Barth and Joel Weinberger of UC Berkeley for reporting this issue.

Important: Mention of third-party websites and products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the selection, performance or use of information or products found at third-party websites. Apple provides this only as a convenience to our users. Apple has not tested the information found on these sites and makes no representations regarding its accuracy or reliability. There are risks inherent in the use of any information or products found on the Internet, and Apple assumes no responsibility in this regard. Please understand that a third-party site is independent from Apple and that Apple has no control over the content on that website. Please contact the vendor for additional information.
Published Date: