Attackers Can Hack Apple Devices Using Image Files
Researchers have identified several remote code execution vulnerabilities in iOS and OS X that could allow malicious hackers to compromise Apple devices using specially crafted image files.
Apple patched tens of vulnerabilities in OS X and iOS this week, including four security holes identified by experts at Cisco Talos. The most serious of the issues is CVE-2016-4631, which affects the ImageIO component in OS X 10.11.5 and prior, and iOS 9.3.2 and prior. It also impacts the watchOS and tvOS operating systems, which are based on iOS.
According to Cisco, the flaw is related to how ImageIO processes tiled TIFF (Tagged Image File Format) files. An attacker can exploit the vulnerability for arbitrary code execution by sending the targeted user a specially crafted image file that triggers a heap-based buffer overflow.
The vulnerability poses a serious threat due to the large number of affected devices and the wide range of potential attack vectors. Researchers said an attacker...(continued)
Researchers have identified several remote code execution vulnerabilities in iOS and OS X that could allow malicious hackers to compromise Apple devices using specially crafted image files.
Apple patched tens of vulnerabilities in OS X and iOS this week, including four security holes identified by experts at Cisco Talos. The most serious of the issues is CVE-2016-4631, which affects the ImageIO component in OS X 10.11.5 and prior, and iOS 9.3.2 and prior. It also impacts the watchOS and tvOS operating systems, which are based on iOS.
According to Cisco, the flaw is related to how ImageIO processes tiled TIFF (Tagged Image File Format) files. An attacker can exploit the vulnerability for arbitrary code execution by sending the targeted user a specially crafted image file that triggers a heap-based buffer overflow.
The vulnerability poses a serious threat due to the large number of affected devices and the wide range of potential attack vectors. Researchers said an attacker...(continued)
