CVE-2015-3733

Vulnerability

A memory corruption vulnerability exists in WebKit as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.1.8, and 8.0.8 [1][2]. The issue is triggered when processing maliciously crafted web content, leading to memory corruption [1][2].

Exploitation

An attacker can host a crafted website that, when visited by a user, exploits the memory corruption [1][2]. No authentication or special network position is required beyond the ability to serve a web page; the user only needs to visit the malicious site [2].

Impact

Successful exploitation allows arbitrary code execution on the affected device or a denial of service (application crash) [1][2]. The attacker gains the same privileges as the user running the browser or the Safari application [1][2].

Mitigation

Apple released iOS 8.4.1 and Safari 6.2.8, 7.1.8, and 8.0.8 on August 13, 2015, which address this vulnerability [1][2]. Users should update to these versions. No workarounds are documented, and there is no known CISA KEV listing for this CVE [1][2].