CVE-2015-5797

Vulnerability

A memory corruption vulnerability exists in WebKit, as used in Apple iOS before 9 and iTunes before 12.3, that allows arbitrary code execution or denial of service via a crafted website. The issue is a different vulnerability than other WebKit CVEs addressed in the same advisories [1][2][3].

Exploitation

An attacker can exploit the vulnerability by luring a user to a maliciously crafted website. No user interaction beyond browsing to the site is required; the attacker does not need any privileged network position or authentication [1][2].

Impact

Successful exploitation of the memory corruption leads to arbitrary code execution within the context of the application (Safari, Mail, or iTunes). The attacker may also trigger a denial of service via application crash. The impact is the full compromise of the affected software's process integrity [1][2][3].

Mitigation

Apple fixed this issue in iOS 9 (released September 16, 2015) and iTunes 12.3. Users should update to the latest versions. No workarounds are available; the mitigation is to apply the patches [1][2][3].