Security News

On Monday, Apple updated its mobile operating system to iOS 8.1.1, which includes bug fixes, increased stability and performance improvements for iPad 2 and iPhone 4s. Apple’s iOS update thwarts a total of nine security flaws.

Apple’s iOS 8.1.1 is available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later.

iOS 8.1.1 addresses the following vulnerabilities:

• CVE-2014-4460 : Website cache may not be fully cleared after leaving private browsing. A privacy issue existed where browsing data could remain in the cache after leaving private browsing. This issue was addressed through a change in caching behavior.
• CVE-2014-4455 : A local user may be able to execute unsigned code. A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed through improved validation of segment sizes.
• CVE-2014-4461 : A malicious application may be able to execute arbitrary code with system privileges. A validation issue existed in the handling of certain metadata fields of IOSharedDataQueue objects. This issue was addressed through relocation of the metadata.
• CVE-2014-4451 : An attacker in possession of a device may exceed the maximum number of failed passcode attempts. In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit.
• CVE-2014-4463 : A person with physical access to the phone may be able to access photos in the Photo Library. The Leave a Message option in FaceTime may have allowed viewing and sending photos from the device. This issue was addressed through improved state management.
• CVE-2014-4457 : A malicious application may be able to launch arbitrary binaries on a trusted device. A permissions issue existed with the debugging functionality for iOS that allowed the spawning of applications on trusted devices that were not being debugged. This was addressed by changes to debugserver’s sandbox.
• CVE-2014-4453 : Unnecessary information is included as part of the initial connection between Spotlight or Safari and the Spotlight Suggestions servers. The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user’s approximate location before a user entered a query. This issue was addressed by removing this information from the initial connection and only sending the user’s approximate location as part of queries.
• CVE-2014-4452, CVE-2014-4462 : Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.

This update is available directly on iOS devices (Settings > General > Software Update), or it can be downloaded and installed in iTunes when a device is connected to a computer with an Internet connection.