CVE-2015-5807

Vulnerability

CVE-2015-5807 is a memory corruption vulnerability in WebKit, the rendering engine used by Apple iOS and iTunes. The issue exists in versions of iOS prior to 9 and iTunes prior to 12.3. A remote attacker can trigger the vulnerability by enticing a user to visit a specially crafted website, leading to memory corruption and application crash.

Exploitation

An attacker needs only to host a malicious website and lure the victim into visiting it. No additional authentication or user interaction beyond the visit is required. The crafted web content exploits a memory handling flaw in WebKit, causing corruption that can be leveraged for code execution.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected device or cause a denial of service (application crash). The attacker gains the same privileges as the WebKit process, which on iOS and iTunes can lead to full system compromise depending on sandbox restrictions.

Mitigation

Apple addressed this vulnerability in iOS 9 [1] and iTunes 12.3 [3]. Users should update to these or later versions. No workarounds are available; the only mitigation is to apply the security updates.