CVE-2015-5790

Vulnerability

CVE-2015-5790 is a memory corruption vulnerability in WebKit, the browser engine used in Apple iOS prior to version 9 and iTunes prior to version 12.3 [1][3]. The bug can be triggered by visiting a maliciously crafted website, leading to memory corruption and application crash. No specific configuration or special conditions are required; simply loading the page in the affected WebKit instance is sufficient.

Exploitation

An attacker needs only to host a crafted website and entice the user to visit it. No authentication or prior access is required. Upon loading the malicious page, the WebKit engine processes the content in a way that causes memory corruption. The precise mechanism is not disclosed, but the result is exploitable memory corruption.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected device, potentially gaining full control, or cause a denial of service via application crash. The compromise occurs at the privilege level of the WebKit process, which can lead to further escalation if combined with other vulnerabilities.

Mitigation

Apple addressed this vulnerability in iOS 9 [1] and iTunes 12.3 [3]. Users should update to these versions or later. No workarounds are available for earlier versions. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.