CVE-2015-6975

Vulnerability

CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 contains a memory corruption vulnerability that can be triggered by processing a crafted font file. The issue occurs when parsing malformed font data, leading to an out-of-bounds memory access. This vulnerability is distinct from CVE-2015-6992 and CVE-2015-7017.

Exploitation

An attacker can exploit this vulnerability by delivering a specially crafted font file to the target system. This can be achieved remotely through a malicious website that embeds the font, or via an email attachment that is opened by the user. No special privileges or authentication are required beyond the ability to process the font file.

Impact

Successful exploitation could result in arbitrary code execution with the privileges of the affected process, potentially allowing full compromise of the system. Alternatively, the attacker may cause a denial of service due to memory corruption, crashing the application.

Mitigation

Apple addressed this vulnerability in iOS 9.1 [2], OS X El Capitan 10.11.1, Security Update 2015-004 Yosemite, and Security Update 2015-007 Mavericks [1], and iTunes 12.3.1 for Windows [3]. Users should update to the latest available versions to protect against this vulnerability.