CVE-2015-5778

Vulnerability

A memory corruption vulnerability exists in CoreMedia Playback, the media playback component of Apple iOS and OS X. The flaw is triggered when processing a specially crafted movie file. Affected versions are iOS before 8.4.1 and OS X before 10.10.5 [1][2].

Exploitation

An attacker can exploit this vulnerability by delivering a malicious movie file to the target user. The user must open the file in an application that uses CoreMedia Playback, such as QuickTime Player or Safari. No additional privileges or authentication are required beyond normal user access. The crafted file causes memory corruption during parsing, leading to a crash or potential code execution.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the application, or cause a denial of service via application crash. This can lead to full system compromise on the affected device.

Mitigation

Apple addressed this vulnerability in iOS 8.4.1 and OS X Yosemite 10.10.5, released on August 13, 2015 [1][2]. Users should update to these versions or later. No workarounds are documented; the only mitigation is applying the security update.