CVE-2015-3730

Vulnerability

A memory corruption vulnerability exists in WebKit, the rendering engine used by Apple iOS (before 8.4.1) and Safari (before 6.2.8, 7.1.8, and 8.0.8). The issue occurs when processing maliciously crafted web content, leading to unstable memory handling. This is one of several WebKit CVEs addressed in APPLE-SA-2015-08-13-1 [1] and APPLE-SA-2015-08-13-3 [2].

Exploitation

An attacker can exploit this vulnerability by hosting a crafted website and enticing a user to visit it using a vulnerable version of Safari or iOS WebKit. No additional authentication or local access is required; the attack is purely remote and relies on user interaction (visiting the malicious site).

Impact

Successful exploitation can lead to arbitrary code execution in the context of the WebKit process, potentially allowing the attacker to take control of the affected device. Alternatively, it may cause a denial of service via application crash due to memory corruption [1][2].

Mitigation

Apple addressed the vulnerability in iOS 8.4.1 for iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later, and in Safari 8.0.8 (OS X Yosemite), Safari 7.1.8 (OS X Mavericks), and Safari 6.2.8 (OS X Mountain Lion) [1][2]. Users should update to the latest available versions. No workarounds are documented. The issue is not listed in CISA's Known Exploited Vulnerabilities catalog.