CVE-2015-3746

Vulnerability

WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, contains a memory corruption issue that can be triggered by processing maliciously crafted web content. This is a different vulnerability than other WebKit CVEs listed in the Apple security updates [1][2].

Exploitation

An attacker can exploit this vulnerability by hosting a crafted website that, when visited by a user, triggers memory corruption in WebKit. No special authentication or network position beyond delivering the web content is required; the victim only needs to load the malicious page in Safari or any application using WebKit on affected iOS versions.

Impact

Successful exploitation allows remote attackers to execute arbitrary code or cause a denial of service (application crash). The precise impact depends on the memory corruption; arbitrary code execution could give the attacker the same privileges as the user running the affected application.

Mitigation

Apple addressed this issue in iOS 8.4.1 [1] and Safari 8.0.8, 7.1.8, and 6.2.8 [2]. Users should update to the latest versions. As of the publication date (August 2015), these updates were available. No workarounds are documented.