CVE-2015-6978

Vulnerability

FontParser in Apple iOS before 9.1 and OS X before 10.11.1 contains a memory corruption vulnerability when processing crafted font files. The issue is triggered during parsing of fonts embedded in PDFs, as described in the ZDI advisory [4]. Affected versions: iOS 9.0 and earlier, OS X 10.11.0 and earlier, and possibly watchOS prior to 2.1 [3].

Exploitation

An attacker can exploit this vulnerability by convincing a user to visit a maliciously crafted website or open a malicious file containing a specially crafted font. User interaction is required (e.g., visiting a page or opening a file) [4]. The specific flaw exists within the parsing of fonts embedded in PDFs, leading to an out-of-bounds access [4].

Impact

Successful exploitation allows remote attackers to execute arbitrary code in the context of the current process (e.g., Safari or other applications using FontParser) or cause a denial of service via memory corruption [1][2][4]. The attacker gains the ability to run arbitrary code with the privileges of the user.

Mitigation

Apple addressed this vulnerability in iOS 9.1 [2], OS X El Capitan 10.11.1, Security Update 2015-004 Yosemite, and Security Update 2015-007 Mavericks [1]. watchOS 2.1 also includes a fix [3]. Users should update to the latest available versions. No workarounds are documented.