About the security content of iOS 8.3

This document describes the security content of iOS 8.3.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see Apple Security Updates.

iOS 8.3

  • AppleKeyStore
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to guess the user's passcode
    Description: iOS allowed access to an interface which allowed attempts to confirm the user's passcode. This issue was addressed with improved entitlement checking.
    CVE-ID
    CVE-2015-1085: Elias Limneos
    Entry updated May 17, 2017
  • Audio Drivers
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to execute arbitrary code with system privileges
    Description: A validation issue existed in IOKit objects used by an audio driver. This issue was addressed through improved validation of metadata.
    CVE-ID
    CVE-2015-1086
  • Backup
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: An attacker may be able to use the backup system to access restricted areas of the file system
    Description: An issue existed in the relative path evaluation logic of the backup system. This issues was addressed through improved path evaluation.
    CVE-ID
    CVE-2015-1087 : TaiG Jailbreak Team
  • Certificate Trust Policy
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Update to the certificate trust policy
    Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/kb/HT204132
  • CFNetwork
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Cookies belonging to one origin may be sent to another origin
    Description: A cross-domain cookie issue existed in redirect handling. Cookies set in a redirect response could be passed on to a redirect target belonging to another origin. The issue was address through improved handling of redirects.
    CVE-ID
    CVE-2015-1089 : Niklas Keller (http://kelunik.com)
  • CFNetwork
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A user may be unable to fully delete browsing history
    Description: Clearing Safari's history did not clear saved HTTP Strict Transport Security state. The issue was addressed through improved data deletion.
    CVE-ID
    CVE-2015-1090
  • CFNetwork Session
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Authentication credentials may be sent to a server on another origin
    Description: A cross-domain HTTP request headers issue existed in redirect handling. HTTP request headers sent in a redirect response could be passed on to another origin. The issue was addressed through improved handling of redirects.
    CVE-ID
    CVE-2015-1091 : Diego Torres (http://dtorres.me)
  • CFURL
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
    Description: An input validation issue existed within URL processing. This issue was addressed through improved URL validation.
    CVE-ID
    CVE-2015-1088
  • Foundation
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: An application using NSXMLParser may be misused to disclose information
    Description: An XML External Entity issue existed in NSXMLParser's handling of XML. This issue was addressed by not loading external entities across origins.
    CVE-ID
    CVE-2015-1092 : Ikuya Fukumoto
  • FontParser
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
    Description: Multiple memory corruption issues existed in the processing of font files. These issues were addressed through improved bounds checking.
    CVE-ID
    CVE-2015-1093 : Marc Schoenefeld
  • IOAcceleratorFamily
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to determine kernel memory layout
    Description: An issue existed in IOAcceleratorFamily that led to the disclosure of kernel memory content. This issue was addressed by removing unneeded code.
    CVE-ID
    CVE-2015-1094 : Cererdlong of Alibaba Mobile Security Team
  • IOHIDFamily
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious HID device may be able to cause arbitrary code execution
    Description: A memory corruption issue existed in an IOHIDFamily API. This issue was addressed through improved memory handling.
    CVE-ID
    CVE-2015-1095 : Andrew Church
  • IOHIDFamily
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to determine kernel memory layout
    Description: An issue existed in IOHIDFamily that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking.
    CVE-ID
    CVE-2015-1096 : Ilja van Sprundel of IOActive
  • IOMobileFramebuffer
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to determine kernel memory layout
    Description: An issue existed in MobileFrameBuffer that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking.
    CVE-ID
    CVE-2015-1097 : Barak Gabai of the IBM X-Force Application Security Research Team
  • iWork Viewer
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Opening a maliciously crafted iWork file may lead to arbitrary code execution
    Description: A memory corruption issue existed in the handling of iWork files. This issue was addressed through improved memory handling.
    CVE-ID
    CVE-2015-1098 : Christopher Hickstein
  • Kernel
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to cause a system denial of service
    Description: A race condition existed in the kernel's setreuid system call. This issue was addressed through improved state management.
    CVE-ID
    CVE-2015-1099 : Mark Mentovai of Google Inc.
  • Kernel
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may escalate privileges using a compromised service intended to run with reduced privileges
    Description: setreuid and setregid system calls failed to drop privileges permanently. This issue was addressed by correctly dropping privileges.
    CVE-ID
    CVE-2015-1117 : Mark Mentovai of Google Inc.
  • Kernel
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to cause unexpected system termination or read kernel memory
    Description: A out of bounds memory access issue existed in the kernel. This issue was addressed through improved memory handling.
    CVE-ID
    CVE-2015-1100 : Maxime Villard of m00nbsd
  • Kernel
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to execute arbitrary code with system privileges
    Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.
    CVE-ID
    CVE-2015-1101 : lokihardt@ASRT working with HP's Zero Day Initiative
  • Kernel
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: An attacker with a privileged network position may be able to cause a denial of service
    Description: A state inconsistency existed in the processing of TCP headers. This issue was addressed through improved state handling.
    CVE-ID
    CVE-2015-1102 : Andrey Khudyakov and Maxim Zhuravlev of Kaspersky Lab
  • Kernel
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: An attacker with a privileged network position may be able to redirect user traffic to arbitrary hosts
    Description: ICMP redirects were enabled by default on iOS. This issue was addressed by disabling ICMP redirects.
    CVE-ID
    CVE-2015-1103 : Zimperium Mobile Security Labs
  • Kernel
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A remote attacker may be able to bypass network filters
    Description: The system would treat some IPv6 packets from remote network interfaces as local packets. The issue was addressed by rejecting these packets.
    CVE-ID
    CVE-2015-1104 : Stephen Roettger of the Google Security Team
  • Kernel
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A remote attacker may be able to cause a denial of service
    Description: A state inconsistency issue existed in the handling of TCP out of band data. This issue was addressed through improved state management.
    CVE-ID
    CVE-2015-1105 : Kenton Varda of Sandstorm.io
  • Keyboards
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: QuickType could learn users' passcodes
    Description: When using Bluetooth keyboards, QuickType could learn users' passcodes. This issue was addressed by preventing QuickType from being displayed on the lockscreen.
    CVE-ID
    CVE-2015-1106 : Jarrod Dwenger, Steve Favorito, Paul Reedy of ConocoPhillips, Pedro Tavares of Molecular Biophysics at UCIBIO/FCT/UNL, De Paul Sunny, Christian Still of Evolve Media, Canada
  • libnetcore
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Processing a maliciously crafted configuration profile may lead to unexpected application termination
    Description: A memory corruption issue existed in the handling of configuration profiles. This issue was addressed through improved bounds checking.
    CVE-ID
    CVE-2015-1118 : Zhaofeng Chen, Hui Xue, Yulong Zhang, and Tao Wei of FireEye, Inc.
  • Lock Screen
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: An attacker in possession of a device may prevent erasing the device after failed passcode attempts
    Description: In some circumstances, a device might not erase itself after failed passcode attempts. This issue was addressed through additional enforcement of erasure.
    CVE-ID
    CVE-2015-1107 : Brent Erickson, Stuart Ryan of University of Technology, Sydney
  • Lock Screen
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: An attacker in possession of a device may exceed the maximum number of failed passcode attempts
    Description: In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit.
    CVE-ID
    CVE-2015-1108
  • NetworkExtension
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: An attacker in possession of a device may be able to recover VPN credentials
    Description: An issue existed in the handling of VPN configuration logs. This issue was addressed by removing logging of credentials.
    CVE-ID
    CVE-2015-1109 : Josh Tway of IPVanish
  • Podcasts
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Unnecessary information may be sent to external servers when downloading podcast assets
    Description: When downloading assets for podcast a user was subscribed to, unique identifiers were sent to external servers. This issue was resolved by removing these identifiers.
    CVE-ID
    CVE-2015-1110 : Alex Selivanov
  • Safari
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A user may be unable to fully delete browsing history
    Description: Clearing Safari's history did not clear "Recently closed tabs". The issue was addressed through improved data deletion.
    CVE-ID
    CVE-2015-1111 : Frode Moe of LastFriday.no
  • Safari
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Users' browsing history may not be completely purged
    Description: A state management issue existed in Safari that resulted in users' browsing history not being purged from history.plist. This issue was addressed by improved state management.
    CVE-ID
    CVE-2015-1112 : William Breuer, The Netherlands
  • Sandbox Profiles
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to access phone numbers or email addresses of recent contacts
    Description: An information disclosure issue existed in the third-party app sandbox. This issue was addressed by improving the sandbox profile.
    CVE-ID
    CVE-2015-1113 : Andreas Kurtz of NESO Security Labs, Markus Troßbach of Heilbronn University
  • Sandbox Profiles
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Hardware identifiers may be accessible by third-party apps
    Description: An information disclosure issue existed in the third-party app sandbox. This issue was addressed by improving the sandbox profile.
    CVE-ID
    CVE-2015-1114

  • Secure Transport
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Processing a maliciously crafted X.509 certificate may lead to unexpected application termination
    Description: A NULL pointer dereference issue existed in the handling of X.509 certificates. This issue was addressed through improved input validation.
    CVE-ID
    CVE-2015-1160 : Elisha Eshed, Roy Iarchy, and Yair Amit of Skycure Security Research
  • Telephony
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: A malicious application may be able to access restricted telephony functions
    Description: An access control issue existed in the telephony subsystem. Sandboxed apps could access restricted telephony functions. This issue was addressed with improved entitlement checking.
    CVE-ID
    CVE-2015-1115 : Andreas Kurtz of NESO Security Labs, Markus Troßbach of Heilbronn University
  • UIKit View
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Sensitive data may be exposed in application snapshots presented in the Task Switcher
    Description: An issue existed in UIKit, which did not blur application snapshots containing sensitive data in the Task Switcher. This issue was addressed by correctly blurring the snapshot.
    CVE-ID
    CVE-2015-1116 : The mobile app team at HP Security Voltage, Aaron Rogers of Mint.com, David Edwards of Tech4Tomorrow, David Zhang of Dropbox
  • WebKit
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Inconsistent user interface may prevent users from discerning a phishing attack
    Description: A user interface inconsistency existed in Safari that allowed an attacker to misrepresent the URL. This issue was addressed through improved user interface consistency checks.
    CVE-ID
    CVE-2015-1084 : Apple
  • WebKit
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
    Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
    CVE-ID
    CVE-2015-1068 : Apple
    CVE-2015-1069 : lokihardt@ASRT working with HP's Zero Day Initiative
    CVE-2015-1070 : Apple
    CVE-2015-1071 : Apple
    CVE-2015-1072
    CVE-2015-1073 : Apple
    CVE-2015-1074 : Apple
    CVE-2015-1076
    CVE-2015-1077 : Apple
    CVE-2015-1078 : Apple
    CVE-2015-1079 : Apple
    CVE-2015-1080 : Apple
    CVE-2015-1081 : Apple
    CVE-2015-1082 : Apple
    CVE-2015-1083 : Apple
    CVE-2015-1119 : Renata Hodovan of University of Szeged / Samsung Electronics
    CVE-2015-1120 : Apple
    CVE-2015-1121 : Apple
    CVE-2015-1122 : Apple
    CVE-2015-1123 : Randy Luecke and Anoop Menon of Google Inc.
    CVE-2015-1124 : Apple
  • WebKit
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Visiting a maliciously crafted website may lead to a user invoking a click on another website
    Description: An issue existed when handling touch events. A tap could propagate to another website. The issue was addressed through improved event handling.
    CVE-ID
    CVE-2015-1125 : Phillip Moon and Matt Weston of www.sandfield.co.nz
  • WebKit
    Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
    Impact: Visiting a maliciously crafted website may lead to resources of another origin being accessed
    Description: An issue existed in WebKit when handling credentials in FTP URLs. This issue was address through improved decoding.
    CVE-ID
    CVE-2015-1126 : Jouko Pynnonen of Klikki Oy
  • Wi-Fi
    Impact: A user's password might be sent to an untrusted Wi-Fi access point
    Description: The screen which reports an untrusted Wi-Fi certificate had only one button which trusted the certificate. A user who did not wish to use the Wi-Fi access point would have had to press the home or lock buttons to escape the screen. This issue was addressed by adding a visible 'Cancel' button.
    CVE-ID
    CVE-2015-5762 : Michael Santos

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: