About the security content of iOS 8.4.1
This document describes the security content of iOS 8.4.1.
For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.
For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.
Where possible, CVE IDs are used to reference the vulnerabilities for further information.
To learn about other security updates, see Apple security updates.
iOS 8.4.1
AppleFileConduit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A maliciously crafted afc command may allow access to protected parts of the filesystem
Description: An issue existed in the symbolic linking mechanism of afc. This issue was addressed by adding additional path checks.
CVE-ID
CVE-2015-5746 : evad3rs, TaiG Jailbreak Team
Air Traffic
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: AirTraffic may have allowed access to protected parts of the filesystem
Description: A path traversal issue existed in asset handling. This was addressed with improved validation.
CVE-ID
CVE-2015-5766 : TaiG Jailbreak Team
Backup
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to create symlinks to protected regions of the disk
Description: An issue existed within the path validation logic for symlinks. This issue was addressed through improved path sanitization.
CVE-ID
CVE-2015-5752 : TaiG Jailbreak Team
bootp
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker may be able to determine Wi-Fi networks a device has previously accessed
Description: Upon connecting to a Wi-Fi network, MAC addresses of previously accessed networks may have been broadcast. This issue was addressed by broadcasting only MAC addresses associated with the current SSID.
CVE-ID
CVE-2015-3778 : Piers O'Hanlon of Oxford Internet Institute, University of Oxford (on the EPSRC Being There project)
Certificate UI
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may be able to accept untrusted certificates from the lock screen
Description: Under certain circumstances, the device may have presented a certificate trust dialog while in a locked state. This issue was addressed through improved state management.
CVE-ID
CVE-2015-3756 : Andy Grant of NCC Group
CloudKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to access the iCloud user record of a previously signed in user
Description: A state inconsistency existed in CloudKit when signing out users. This issue was addressed through improved state handling.
CVE-ID
CVE-2015-3782 : Deepkanwal Plaha of University of Toronto
CFPreferences
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious app may be able to read other apps' managed preferences
Description: An issue existed in the third-party app sandbox. This issue was addressed by improving the third-party sandbox profile.
CVE-ID
CVE-2015-3793 : Andreas Weinlein of the Appthority Mobility Threat Team
Code Signing
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute unsigned code
Description: An issue existed that allowed unsigned code to be appended to signed code in a specially crafted executable file. This issue was addressed through improved code signature validation.
CVE-ID
CVE-2015-3806 : TaiG Jailbreak Team
Code Signing
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A specially crafted executable file could allow unsigned, malicious code to execute
Description: An issue existed in the way multi-architecture executable files were evaluated that could have allowed unsigned code to be executed. This issue was addressed through improved validation of executable files.
CVE-ID
CVE-2015-3803 : TaiG Jailbreak Team
Code Signing
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to execute unsigned code
Description: A validation issue existed in the handling of Mach-O files. This was addressed by adding additional checks.
CVE-ID
CVE-2015-3802 : TaiG Jailbreak Team
CVE-2015-3805 : TaiG Jailbreak Team
CoreMedia Playback
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in CoreMedia Playback. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5777 : Apple
CVE-2015-5778 : Apple
CoreText
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation.
CVE-ID
CVE-2015-5755 : John Villamil (@day6reak), Yahoo Pentest Team
CVE-2015-5761 : John Villamil (@day6reak), Yahoo Pentest Team
DiskImages
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted DMG file may lead to an unexpected application termination or arbitrary code execution with system privileges
Description: A memory corruption issue existed in parsing of malformed DMG images. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-3800 : Frank Graziano of the Yahoo Pentest Team
FontParser
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation.
CVE-ID
CVE-2015-3804 : Apple
CVE-2015-5756 : John Villamil (@day6reak), Yahoo Pentest Team
CVE-2015-5775 : Apple
ImageIO
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted .tiff file may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the processing of .tiff files. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2015-5758 : Apple
ImageIO
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may result in the disclosure of process memory
Description: An uninitialized memory access issue existed in ImageIO's handling of PNG images. Visiting a malicious website may result in sending data from process memory to the website. This issue was addressed through improved memory initialization and additional validation of PNG images.
CVE-ID
CVE-2015-5781 : Michal Zalewski
ImageIO
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may result in the disclosure of process memory
Description: An uninitialized memory access issue existed in ImageIO's handling of TIFF images. Visiting a malicious website may result in sending data from process memory to the website. This issue is addressed through improved memory initialization and additional validation of TIFF images.
CVE-ID
CVE-2015-5782 : Michal Zalewski
IOKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Parsing a maliciously crafted plist may lead to an unexpected application termination or arbitrary code execution with system privileges
Description: A memory corruption existed in processing of malformed plists. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-3776 : Teddy Reed of Facebook Security, Patrick Stein (@jollyjinx) of Jinx Germany
IOHIDFamily
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A buffer overflow issue existed in IOHIDFamily. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5774 : TaiG Jailbreak Team
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to determine kernel memory layout
Description: An issue existed in the mach_port_space_info interface, which could have led to the disclosure of kernel memory layout. This was addressed by disabling the mach_port_space_info interface.
CVE-ID
CVE-2015-3766 : Cererdlong of Alibaba Mobile Security Team, @PanguTeam
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: An integer overflow existed in the handling of IOKit functions. This issue was addressed through improved validation of IOKit API arguments.
CVE-ID
CVE-2015-3768 : Ilja van Sprundel
Kernel
iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to bypass background execution restrictions
Description: An access issue existed with certain debugging mechanisms. This issue was addressed by adding additional validation checks.
CVE-ID
CVE-2015-5787 : Alessandro Reina, Mattia Pagnozzi and Stefano Bianchi Mazzone of FireEye
Libc
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted regular expression may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the TRE library. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-3796 : Ian Beer of Google Project Zero
CVE-2015-3797 : Ian Beer of Google Project Zero
CVE-2015-3798 : Ian Beer of Google Project Zero
Libinfo
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in handling AF_INET6 sockets. This issue was addressed by improved memory handling.
CVE-ID
CVE-2015-5776 : Apple
libpthread
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in handling syscalls. This issue was addressed through improved lock state checking.
CVE-ID
CVE-2015-5757 : Lufeng Li of Qihoo 360
libxml2
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Parsing a maliciously crafted XML document may lead to disclosure of user information
Description: A memory corruption issue existed in parsing of XML files. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-3807 : Michal Zalewski
libxml2
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Multiple vulnerabilities existed in libxml2 versions prior to 2.9.2, the most serious of which may allow a remote attacker to cause a denial of service
Description: Multiple vulnerabilities existed in libxml2 versions prior to 2.9.2. These were addressed by updating libxml2 to version 2.9.2.
CVE-ID
CVE-2014-0191 : Felix Groebert of Google
CVE-2014-3660 : Felix Groebert of Google
libxpc
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in handling of malformed XPC messages. This issue was improved through improved bounds checking.
CVE-ID
CVE-2015-3795 : Mathew Rowley
Location Framework
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A local user may be able to modify protected parts of the filesystem
Description: A symbolic link issue was addressed through improved path validation.
CVE-ID
CVE-2015-3759 : Cererdlong of Alibaba Mobile Security Team
MobileInstallation
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious enterprise application may be able to replace extensions for other apps
Description: An issue existed in the install logic for universal provisioning profile apps, which allowed a collision to occur with existing bundle IDs. This issue was addressed through improved bundle ID validation.
CVE-ID
CVE-2015-5770: Zhaofeng Chen, Yulong Zhang, and Tao Wei of FireEye, Inc
MSVDX Driver
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Viewing a malicious video may lead to a unexpected system termination
Description: A denial of service issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5769 : Proteas of Qihoo 360 Nirvan Team
Office Viewer
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Parsing a maliciously crafted XML file may lead to disclosure of user information
Description: An external entity reference issue existed in XML file parsing. This issue was addressed through improved parsing.
CVE-ID
CVE-2015-3784 : Bruno Morisson of INTEGRITY S.A.
QL Office
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in parsing of office documents. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5773 : Apple
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a malicious website may lead to user interface spoofing
Description: A malicious website could open another site and prompt for user input without a way for the user to tell where the prompt originated. The issue was addressed by displaying the prompt's origin to the user.
CVE-ID
CVE-2015-3729 : Code Audit Labs of VulnHunt.com
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious website may trigger an infinite number of alert messages
Description: An issue existed where a malicious or hacked website could show infinite alert messages and make users believe their browser was locked. The issue was addressed through throttling of JavaScript alerts.
CVE-ID
CVE-2015-3763
Sandbox_profiles
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An malicious app may be able to read other apps' managed preferences
Description: An issue existed in the third-party app sandbox. This issue was addressed by improving the third-party sandbox profile.
CVE-ID
CVE-2015-5749 : Andreas Weinlein of the Appthority Mobility Threat Team
UIKit WebView
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to initiate FaceTime calls without user authorization
Description: An issue existed in the parsing of FaceTime URLs within WebViews. This issue was addressed through improved URL validation.
CVE-ID
CVE-2015-3758 : Brian Simmons of Salesforce, Guillaume Ross
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
CVE-ID
CVE-2015-3730 : Apple
CVE-2015-3731 : Apple
CVE-2015-3732 : Apple
CVE-2015-3733 : Apple
CVE-2015-3734 : Apple
CVE-2015-3735 : Apple
CVE-2015-3736 : Apple
CVE-2015-3737 : Apple
CVE-2015-3738 : Apple
CVE-2015-3739 : Apple
CVE-2015-3740 : Apple
CVE-2015-3741 : Apple
CVE-2015-3742 : Apple
CVE-2015-3743 : Apple
CVE-2015-3744 : Apple
CVE-2015-3745 : Apple
CVE-2015-3746 : Apple
CVE-2015-3747 : Apple
CVE-2015-3748 : Apple
CVE-2015-3749 : Apple
Web
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a malicious website may lead to user interface spoofing
Description: Navigating to a malformed URL may have allowed a malicious website to display an arbitrary URL. This issue was addressed through improved URL handling.
CVE-ID
CVE-2015-3755 : xisigr of Tencent's Xuanwu Lab
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious website may exfiltrate image data cross-origin
Description: Images fetched through URLs that redirected to a data:image resource could have been exfiltrated cross-origin. This issue was addressed through improved canvas taint tracking.
CVE-ID
CVE-2015-3753 : Antonio Sanso and Damien Antipa of Adobe
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious website can trigger plaintext requests to an origin under HTTP Strict Transport Security
Description: An issue existed where Content Security Policy report requests would not honor HTTP Strict Transport Security (HSTS). The issue was addressed by applying HSTS to CSP.
CVE-ID
CVE-2015-3750 : Muneaki Nishimura (nishimunea)
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious website can make a tap event produce a synthetic click on another page
Description: An issue existed in how synthetic clicks are generated from tap events that could cause clicks to target other pages. The issue was addressed through restricted click propagation.
CVE-ID
CVE-2015-5759 : Phillip Moon and Matt Weston of Sandfield
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Content Security Policy report requests may leak cookies
Description: Two issues existed in how cookies were added to Content Security Policy report requests. Cookies were sent in cross-origin report requests in violation of the standard. Cookies set during regular browsing were sent in private browsing. These issues were addressed through improved cookie handling.
CVE-ID
CVE-2015-3752 : Muneaki Nishimura (nishimunea)
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Image loading may violate a website's Content Security Policy directive
Description: An issue existed where websites with video controls would load images nested in object elements in violation of the website's Content Security Policy directive. This issue was addressed through improved Content Security Policy enforcement.
CVE-ID
CVE-2015-3751 : Muneaki Nishimura (nishimunea)
FaceTime is not available in all countries or regions.
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.