CVE-2015-5756

Vulnerability

FontParser, the font processing component in Apple iOS and OS X, contains a memory corruption vulnerability that can be triggered by processing a crafted font file. The issue affects iOS versions before 8.4.1 and OS X versions before 10.10.5 (Yosemite) [1][2]. The vulnerability is distinct from CVE-2015-3804 and CVE-2015-5775.

Exploitation

An attacker can exploit this vulnerability by delivering a specially crafted font file to the target system, for example via a malicious web page, email attachment, or other means that cause the font to be processed by FontParser. No authentication is required, but user interaction (e.g., opening a document or viewing a web page) may be necessary to trigger the parsing [description].

Impact

Successful exploitation can lead to arbitrary code execution in the context of the affected application, or cause a denial of service through memory corruption and application crash. The attacker gains the ability to execute arbitrary code with the privileges of the user running the vulnerable software [description].

Mitigation

Apple addressed this vulnerability in iOS 8.4.1 and OS X Yosemite 10.10.5 (including Security Update 2015-006) [1][2]. Users should update to these or later versions. No workarounds are documented; applying the security updates is the recommended mitigation.