[telecom] APPLE-SA-2011-11-10-1 iOS 5.0.1 Software Update

Monty Solomon · 2011-11-24T06:11:54+00:00

APPLE-SA-2011-11-10-1 iOS 5.0.1 Software UpdateiOS 5.0.1 Software Update is now available and addresses thefollowing:CFNetworkAvailable for: iOS 3.0 through 5.0 for iPhone 3GS,iPhone 4 and iPhone 4S,iOS 3.1 through 5.0 for iPod touch (3rd generation) and later,iOS 3.2 through 5.0 for iPad, iOS 4.3 through 5.0 for iPad 2Impact: Visiting a maliciously crafted website may lead to thedisclosure of sensitive informationDescription: An issue existed in CFNetwork's handling of maliciouslycrafted URLs. When accessing a maliciously crafted HTTP or HTTPS URL,CFNetwork could navigate to an incorrect server.CVE-IDCVE-2011-3246 : Erling Ellingsen of FacebookCoreGraphicsAvailable for: iOS 3.0 through 5.0 for iPhone 3GS,iPhone 4 and iPhone 4S,iOS 3.1 through 5.0 for iPod touch (3rd generation) and later,iOS 3.2 through 5.0 for iPad, iOS 4.3 through 5.0 for iPad 2Impact: Viewing a document containing a maliciously crafted font maylead to arbitrary code executionDescription: Multiple memory corruption issues existed in FreeType,the most serious of which may lead to arbitrary code execution whenprocessing a maliciously crafted font.CVE-IDCVE-2011-3439 : AppleData SecurityAvailable for: iOS 3.0 through 5.0 for iPhone 3GS,iPhone 4 and iPhone 4S,iOS 3.1 through 5.0 for iPod touch (3rd generation) and later,iOS 3.2 through 5.0 for iPad, iOS 4.3 through 5.0 for iPad 2Impact: An attacker with a privileged network position may interceptuser credentials or other sensitive informationDescription: Two certificate authorities in the list of trusted rootcertificates have independently issued intermediate certificates toDigiCert Malaysia. DigiCert Malaysia has issued certificates withweak keys that it is unable to revoke. An attacker with a privilegednetwork position could intercept user credentials or other sensitiveinformation intended for a site with a certificate issued by DigiCertMalaysia. This issue is addressed by configuring default system trustsettings so that DigiCert...

Nov 24, 2011 0 Replies

Rate this thread:

***** Moderator's Note *****

I'm disappointed that Apple has forced its customers to install "itunes" in order to get security updates, and I'm not going to believe that it's easier or more efficient or anything but a tawdry ploy to sell more mp3's.

BTW, I recommend that _all_ computer users remove _all_ root certificates issued by authorities involved with breaches such as the one mentioned above: IMNSHHO, a gaffe like that one is proof that the authortiy and it's certificates can't be trusted.

Bill Horne Moderator

[telecom] APPLE-SA-2011-11-10-1 iOS 5.0.1 Software Update

Join the Discussion

Didn't find your answer?