About the security content of iOS 9.3.2
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Accessibility
Impact: An application may be able to determine kernel memory layout
Description: A buffer overflow was addressed through improved size validation.
CFNetwork Proxies
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: An information leak existed in the handling of HTTP and HTTPS requests. This issue was addressed through improved URL handling.
CommonCrypto
Impact: A malicious application may be able to leak sensitive user information
Description: An issue existed in the handling of return values in CCCrypt. This issue was addressed through improved key length management.
CoreCapture
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A null pointer dereference was addressed through improved validation.
Disk Images
Impact: A local attacker may be able to read kernel memory
Description: A race condition was addressed through improved locking.
Disk Images
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue existed in the parsing of disk images. This issue was addressed through improved memory handling.
ImageIO
Impact: Processing a maliciously crafted image may lead to a denial of service
Description: A null pointer dereference was addressed through improved validation.
IOAcceleratorFamily
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: Multiple memory corruption issues were addressed through improved memory handling.
IOAcceleratorFamily
Impact: An application may be able to cause a denial of service
Description: A null pointer dereference was addressed through improved locking.
IOAcceleratorFamily
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A null pointer dereference was addressed through improved validation.
IOHIDFamily
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed through improved memory handling.
Kernel
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: Multiple memory corruption issues were addressed through improved memory handling.
libc
Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed through improved input validation.
libxml2
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues were addressed through improved memory handling.
libxslt
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved memory handling.
MapKit
Impact: An attacker in a privileged network position may be able to leak sensitive user information
Description: Shared links were sent with HTTP rather than HTTPS. This was addressed by enabling HTTPS for shared links.
OpenGL
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed through improved memory handling.
Safari
Impact: A user may be unable to fully delete browsing history
Description: "Clear History and Website Data" did not clear the history. The issue was addressed through improved data deletion.
Siri
Impact: A person with physical access to an iOS device may be able to use Siri to access contacts and photos from the the lock screen
Description: A state management issue existed when accessing Siri results on the lock screen. This issue was addressed by disabling data detectors in Twitter results when the device is locked.
WebKit
Impact: Visiting a malicious website may disclose data from another website
Description: An insufficient taint tracking issue in the parsing of svg images was addressed through improved taint tracking.
WebKit
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed through improved memory handling.
WebKit Canvas
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed through improved memory handling.
