CVE-2015-5791

Vulnerability

CVE-2015-5791 is a memory corruption vulnerability in WebKit, specifically in the JavaScriptCore component, as used in Apple iOS versions prior to 9 and iTunes versions prior to 12.3. The issue can be triggered by visiting a crafted malicious website, leading to memory corruption and application crash. The vulnerability is distinct from other WebKit CVEs addressed in the same security updates [1][2][3].

Exploitation

An attacker can exploit this vulnerability by hosting a specially crafted website and enticing a user to visit it. No additional authentication or user interaction beyond visiting the site is required. The attack vector is remote, and the attacker does not need any prior access to the target device.

Impact

Successful exploitation allows a remote attacker to execute arbitrary code on the affected system or cause a denial of service (application crash). The attacker gains the ability to run code at the privilege level of the WebKit process, which could lead to full compromise of the device or application.

Mitigation

Apple addressed this vulnerability in iOS 9 (released September 16, 2015) and iTunes 12.3 (released September 16, 2015). Users should update to these versions or later. No workarounds are available for unpatched versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.