CVE-2015-3807

Vulnerability

libxml2 in Apple iOS before 8.4.1 and OS X before 10.10.5 contains a memory corruption vulnerability that can be triggered by parsing a specially crafted XML document. No special configuration is required; the vulnerability exists in the system's XML parsing library used by various applications.

Exploitation

An attacker can remotely exploit this vulnerability by delivering a crafted XML document to the target system, for example via a malicious web page or email attachment. No authentication is needed. The attack requires user interaction (e.g., opening the document) but no prior access privileges.

Impact

Successful exploitation allows an attacker to obtain sensitive information from process memory (information disclosure) or cause a denial of service via memory corruption. The impact is limited to the process that parses the malicious XML; no privilege escalation to system level is indicated.

Mitigation

Apple addressed this vulnerability in iOS 8.4.1 [2] and OS X 10.10.5 [1]. Users should update to these or later versions. No workarounds are available; updating is the only mitigation.