CVE-2015-5758

Vulnerability

A memory corruption vulnerability exists in the ImageIO component of Apple iOS before 8.4.1 and OS X before 10.10.5. The bug is triggered when the system processes a crafted TIFF image file, leading to memory corruption. The affected versions are iOS 8.4 and earlier, and OS X 10.10.4 and earlier [1][2].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted TIFF image to the target system. This can be achieved remotely, for example by tricking a user into viewing the malicious image via a web page, email attachment, or other means that causes ImageIO to parse the file. No authentication is required; the attacker only needs to deliver the image and have the target process it using the vulnerable ImageIO implementation [1][2].

Impact

Successful exploitation can lead to arbitrary code execution with the privileges of the application using ImageIO, or cause a denial of service through application crash. The impact is system compromise or service disruption, depending on how the attacker uses the memory corruption [1][2].

Mitigation

Apple released fixes in iOS 8.4.1 and OS X Yosemite v10.10.5 (Security Update 2015-006). Users should update to these versions or later. No workarounds are documented in the available references [1][2].