APPLE-SA-2011-10-12-1 iOS 5 Software Update [telecom]

Monty Solomon · 2011-10-15T13:37:50+00:00

APPLE-SA-2011-10-12-1 iOS 5 Software UpdateiOS 5 Software Update is now available and addresses the following:CalDAVAvailable for: iOS 3.0 through 4.3.5 for iPhone 3GS and iPhone 4,iOS 3.1 through 4.3.5 for iPod touch (3rd generation) and later,iOS 3.2 through 4.3.5 for iPadImpact: An attacker with a privileged network position may interceptuser credentials or other sensitive information from a CalDAVcalendar serverDescription: CalDAV did not check that the SSL certificate presentedby the server was trusted.CVE-IDCVE-2011-3253 : Leszek Tasiemski of nSenseCalendarAvailable for: iOS 4.2.0 through 4.3.5 for iPhone 3GS and iPhone 4,iOS 4.2.0 through 4.3.5 for iPod touch (3rd generation) and later,iOS 4.2.0 through 4.3.5 for iPadImpact: Viewing a maliciously crafted calendar invitation may injectscript in the local domainDescription: A script injection issue existed in Calendar's handlingof invitation notes. This issue is addressed through improvedescaping of special characters in invitation notes. This issues doesnot affect devices prior to iOS 4.2.0.CVE-IDCVE-2011-3254 : Rick DeaconCFNetworkAvailable for: iOS 3.0 through 4.3.5 for iPhone 3GS and iPhone 4,iOS 3.1 through 4.3.5 for iPod touch (3rd generation) and later,iOS 3.2 through 4.3.5 for iPadImpact: User's AppleID password may be logged to a local fileDescription: A user's AppleID password and username were logged to afile that was readable by applications on the system. This isresolved by no longer logging these credentials.CVE-IDCVE-2011-3255 : Peter Quade of qdevelopCFNetworkAvailable for: iOS 3.0 through 4.3.5 for iPhone 3GS and iPhone 4,iOS 3.1 through 4.3.5 for iPod touch (3rd generation) and later,iOS 3.2 through 4.3.5 for iPadImpact: Visiting a maliciously crafted website may lead to thedisclosure of sensitive informationDescription: An issue existed in CFNetwork's handling of HTTPcookies. When accessing a maliciously crafted HTTP or HTTPS URL,CFNetwork could incorrectly send the cookies for a...