CVE-2015-3735

Vulnerability

CVE-2015-3735 is a memory corruption issue in WebKit, the rendering engine used by Apple iOS and Safari. The vulnerability exists in versions of iOS prior to 8.4.1 and Safari prior to 6.2.8, 7.1.8, and 8.0.8. Processing a specially crafted website can trigger the corruption, leading to unexpected behavior [1][2].

Exploitation

An attacker can exploit this vulnerability by hosting a malicious website and enticing a user to visit it. No additional privileges or user interaction beyond browsing the site are required. The exact sequence of steps involves the attacker crafting web content that triggers the memory corruption when parsed by WebKit [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected device or cause a denial of service (application crash). The code executes at the privilege level of the WebKit process, which can lead to full compromise of the browser or, on iOS, potentially the entire device [1][2].

Mitigation

Apple addressed this vulnerability in iOS 8.4.1 (released August 13, 2015) and Safari 6.2.8, 7.1.8, and 8.0.8 (also released August 13, 2015). Users should update to these versions or later. No workarounds are documented [1][2].