Security News

Last week brought a tidal wave of security updates for various Apple software and third-party applications, including Thursday’s iOS 8.4.1 update — which tackles a whopping 71 vulnerabilities in Apple’s mobile operating system.

iOS 8.4.1 is available for: iPhone 4s and later, iPod touch (5th generation) and later, as well as iPad 2 and later.

In general, the iOS 8.4.1 release includes improvements and fixes to Apple Music, as well as solutions to some iCloud Music Library annoyances. Apple describes these updates as follows:

• Resolves issues that could prevent turning on iCloud Music Library
• Resolves an issue that hides added music because Apple Music was set to show offline music only
• Provides a way to add songs to a new playlist if there aren’t any playlists to choose from
• Resolves an issue that may show different artwork for an album on other devices
• Resolves several issues for artists while posting to Connect
• Fixes an issue where tapping Love doesn’t work as expected while listening to Beats 1

The vulnerabilities this update patches are described as follows:

• CVE-2015-5746 : A maliciously crafted afc command may allow access to protected parts of the filesystem. An issue existed in the symbolic linking mechanism of afc. This issue was addressed by adding additional path checks.
• CVE-2015-5766 : AirTraffic may have allowed access to protected parts of the filesystem. A path traversal issue existed in asset handling. This was addressed with improved validation.
• CVE-2015-5752 : A malicious application may be able to create symlinks to protected regions of the disk. An issue existed within the path validation logic for symlinks. This issue was addressed through improved path sanitization.
• CVE-2015-3778 : A malicious Wi-Fi network may be able to determine networks a device has previously accessed. Upon connecting to a Wi-Fi network, iOS may have broadcast MAC addresses of previously accessed networks via the DNAv4 protocol. This issue was addressed through disabling DNAv4 on unencrypted Wi-Fi networks.
• CVE-2015-3756 : An attacker with a privileged network position may be able to accept untrusted certificates from the lock screen. Under certain circumstances, the device may have presented a certificate trust dialog while in a locked state. This issue was addressed through improved state management.
• CVE-2015-3782 : A malicious application may be able to access the iCloud user record of a previously signed in user. A state inconsistency existed in CloudKit when signing out users. This issue was addressed through improved state handling.
• CVE-2015-3793 : A malicious app may be able to read other apps’ managed preferences. An issue existed in the third-party app sandbox. This issue was addressed by improving the third-party sandbox profile.
• CVE-2015-3806 : A malicious application may be able to execute unsigned code. An issue existed that allowed unsigned code to be appended to signed code in a specially crafted executable file. This issue was addressed through improved code signature validation.
• CVE-2015-3803 : A specially crafted executable file could allow unsigned, malicious code to execute. An issue existed in the way multi-architecture executable files were evaluated that could have allowed unsigned code to be executed. This issue was addressed through improved validation of executable files.
• CVE-2015-3802, CVE-2015-3805 : A local user may be able to execute unsigned code. A validation issue existed in the handling of Mach-O files. This was addressed by adding additional checks.
• CVE-2015-5777, CVE-2015-5778 : Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. A memory corruption issue existed in CoreMedia Playback. This issue was addressed through improved memory handling.
• CVE-2015-5755, CVE-2015-5761 : Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution. A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation.
• CVE-2015-3800 : Processing a maliciously crafted DMG file may lead to an unexpected application termination or arbitrary code execution with system privileges. A memory corruption issue existed in parsing of malformed DMG images. This issue was addressed through improved memory handling.
• CVE-2015-3804, CVE-2015-5756, CVE-2015-5775 : Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution. A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation.
• CVE-2015-5758 : Processing a maliciously crafted .tiff file may lead to an unexpected application termination or arbitrary code execution. A memory corruption issue existed in the processing of .tiff files. This issue was addressed through improved bounds checking.
• CVE-2015-5781 : Visiting a maliciously crafted website may result in the disclosure of process memory. An uninitialized memory access issue existed in ImageIO’s handling of PNG images. Visiting a malicious website may result in sending data from process memory to the website. This issue was addressed through improved memory initialization and additional validation of PNG images.
• CVE-2015-5782 : Visiting a maliciously crafted website may result in the disclosure of process memory. An uninitialized memory access issue existed in ImageIO’s handling of TIFF images. Visiting a malicious website may result in sending data from process memory to the website. This issue is addressed through improved memory initialization and additional validation of TIFF images.
• CVE-2015-3776 : Parsing a maliciously crafted plist may lead to an unexpected application termination or arbitrary code execution with system privileges. A memory corruption existed in processing of malformed plists. This issue was addressed through improved memory handling.
• CVE-2015-5774 : A local user may be able to execute arbitrary code with system privileges. A buffer overflow issue existed in IOHIDFamily. This issue was addressed through improved memory handling.
• CVE-2015-3766 : A malicious application may be able to determine kernel memory layout. An issue existed in the mach_port_space_info interface, which could have led to the disclosure of kernel memory layout. This was addressed by disabling the mach_port_space_info interface.
• CVE-2015-3768 : A malicious application may be able to execute arbitrary code with system privileges. An integer overflow existed in the handling of IOKit functions. This issue was addressed through improved validation of IOKit API arguments.
• CVE-2015-3796, CVE-2015-3797, CVE-2015-3798 : Processing a maliciously crafted regular expression may lead to an unexpected application termination or arbitrary code execution. A memory corruption issue existed in the TRE library. This issue was addressed through improved memory handling.
• CVE-2015-5776 : A remote attacker may be able to cause unexpected application termination or arbitrary code execution. A memory corruption issue existed in handling AF_INET6 sockets. This issue was addressed by improved memory handling.
• CVE-2015-5757 : A malicious application may be able to execute arbitrary code with system privileges. A memory corruption issue existed in handling syscalls. This issue was addressed through improved lock state checking.
• CVE-2015-3807 : Parsing a maliciously crafted XML document may lead to disclosure of user information. A memory corruption issue existed in parsing of XML files. This issue was addressed through improved memory handling.
• CVE-2012-6685, CVE-2014-0191, CVE-2014-3660 : Multiple vulnerabilities existed in libxml2 versions prior to 2.9.2, the most serious of which may allow a remote attacker to cause a denial of service. Multiple vulnerabilities existed in libxml2 versions prior to 2.9.2. These were addressed by updating libxml2 to version 2.9.2.
• CVE-2015-3795 : A malicious application may be able to execute arbitrary code with system privileges. A memory corruption issue existed in handling of malformed XPC messages. This issue was improved through improved bounds checking.
• CVE-2015-3759 : A local user may be able to modify protected parts of the filesystem. A symbolic link issue was addressed through improved path validation.
• CVE-2015-5770 : A malicious enterprise application may be able to replace extensions for other apps. An issue existed in the install logic for universal provisioning profile apps, which allowed a collision to occur with existing bundle IDs. This issue was addressed through improved bundle ID validation.
• CVE-2015-5769 : Viewing a malicious video may lead to a unexpected system termination. A denial of service issue was addressed through improved memory handling.
• CVE-2015-3784 : Parsing a maliciously crafted XML file may lead to disclosure of user information. An external entity reference issue existed in XML file parsing. This issue was addressed through improved parsing.
• CVE-2015-5773 : Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution. A memory corruption issue existed in parsing of office documents. This issue was addressed through improved memory handling.
• CVE-2015-3729 : Visiting a malicious website may lead to user interface spoofing. A malicious website could open another site and prompt for user input without a way for the user to tell where the prompt originated. The issue was addressed by displaying the prompt’s origin to the user.
• CVE-2015-3763 : A malicious website may trigger an infinite number of alert messages. An issue existed where a malicious or hacked website could show infinite alert messages and make users believe their browser was locked. The issue was addressed through throttling of JavaScript alerts.
• CVE-2015-5749 : An malicious app may be able to read other apps’ managed preferences. An issue existed in the third-party app sandbox. This issue was addressed by improving the third-party sandbox profile.
• CVE-2015-3758 : A malicious application may be able to initiate FaceTime calls without user authorization. An issue existed in the parsing of FaceTime URLs within WebViews. This issue was addressed through improved URL validation.
• CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749 : Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
• CVE-2015-3755 : Visiting a malicious website may lead to user interface spoofing. Navigating to a malformed URL may have allowed a malicious website to display an arbitrary URL. This issue was addressed through improved URL handling.
• CVE-2015-3753 : A malicious website may exfiltrate image data cross-origin. Images fetched through URLs that redirected to a data:image resource could have been exfiltrated cross-origin. This issue was addressed through improved canvas taint tracking.
• CVE-2015-3750 : A malicious website can trigger plaintext requests to an origin under HTTP Strict Transport Security. An issue existed where Content Security Policy report requests would not honor HTTP Strict Transport Security (HSTS). The issue was addressed by applying HSTS to CSP.
• CVE-2015-5759 : A malicious website can make a tap event produce a synthetic click on another page. An issue existed in how synthetic clicks are generated from tap events that could cause clicks to target other pages. The issue was addressed through restricted click propagation.
• CVE-2015-3752 : Content Security Policy report requests may leak cookies. Two issues existed in how cookies were added to Content Security Policy report requests. Cookies were sent in cross-origin report requests in violation of the standard. Cookies set during regular browsing were sent in private browsing. These issues were addressed through improved cookie handling.
• CVE-2015-3751 : Image loading may violate a website’s Content Security Policy directive. An issue existed where websites with video controls would load images nested in object elements in violation of the website’s Content Security Policy directive. This issue was addressed through improved Content Security Policy enforcement.

iPhone, iPad, and iPod users can get the latest update directly on the iOS devices (Settings > General > Software Update), or it can be downloaded and installed in iTunes when the iOS device is connected to a computer with an Internet connection.