CVE-2015-3737

Vulnerability

CVE-2015-3737 is a memory corruption vulnerability in WebKit, the rendering engine used by Apple's Safari browser and iOS. The issue affects iOS versions before 8.4.1 and Safari versions before 6.2.8 on OS X Mountain Lion, before 7.1.8 on OS X Mavericks, and before 8.0.8 on OS X Yosemite [1][2]. The vulnerability is triggered when processing maliciously crafted web content, leading to memory corruption.

Exploitation

An attacker can exploit this vulnerability by luring a victim to visit a specially crafted website. No additional privileges or user interaction beyond normal browsing is required. The attacker does not need to be on the same network; the website can be hosted remotely.

Impact

Successful exploitation can lead to arbitrary code execution with the privileges of the Safari or WebKit process. Alternatively, it may cause a denial of service due to application crash. The impact is device-wide for iOS or user-level for OS X.

Mitigation

Apple addressed this vulnerability in iOS 8.4.1 released on August 13, 2015 [1], and in Safari 6.2.8, 7.1.8, and 8.0.8 released on the same date [2]. Users are advised to update to the latest versions. No workarounds are available.