CVE-2015-5942

Vulnerability

FontParser in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 contains a memory corruption issue that can be triggered when processing a crafted font file. The vulnerability is distinct from CVE-2015-5927 but affects the same component [1][2][3].

Exploitation

An attacker can exploit this vulnerability by luring a user to open a malicious font file—for example, via a specially crafted web page, email attachment, or other delivery mechanism. No additional authentication or special privileges are required beyond user interaction to open the file [1][2].

Impact

Successful exploitation leads to arbitrary code execution in the context of the affected application or system, or a denial of service due to memory corruption. The attacker gains the ability to execute arbitrary commands or crash the process, potentially leading to full system compromise on the targeted device [1][2][3].

Mitigation

Apple addressed this vulnerability in iOS 9.1, OS X El Capitan 10.11.1 (and corresponding security updates for Yosemite and Mavericks), and watchOS 2.0.1, all released on October 21, 2015. Users should update to these versions or later. No workarounds are documented; the only mitigation is to apply the available patches [1][2][3].