-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2015.2426
                        APPLE-SA-2015-09-16-1 iOS 9
                             17 September 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           iOS
Publisher:         Apple
Operating System:  Apple iOS
Impact/Access:     Access Privileged Data          -- Remote/Unauthenticated      
                   Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Root Compromise                 -- Console/Physical            
                   Denial of Service               -- Remote/Unauthenticated      
                   Provide Misleading Information  -- Remote/Unauthenticated      
                   Access Confidential Data        -- Console/Physical            
                   Unauthorised Access             -- Console/Physical            
                   Reduced Security                -- Console/Physical            
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-5921 CVE-2015-5916 CVE-2015-5912
                   CVE-2015-5907 CVE-2015-5906 CVE-2015-5905
                   CVE-2015-5904 CVE-2015-5903 CVE-2015-5899
                   CVE-2015-5898 CVE-2015-5896 CVE-2015-5895
                   CVE-2015-5892 CVE-2015-5885 CVE-2015-5882
                   CVE-2015-5880 CVE-2015-5879 CVE-2015-5876
                   CVE-2015-5874 CVE-2015-5869 CVE-2015-5868
                   CVE-2015-5867 CVE-2015-5863 CVE-2015-5862
                   CVE-2015-5861 CVE-2015-5860 CVE-2015-5858
                   CVE-2015-5857 CVE-2015-5856 CVE-2015-5855
                   CVE-2015-5851 CVE-2015-5850 CVE-2015-5848
                   CVE-2015-5847 CVE-2015-5846 CVE-2015-5845
                   CVE-2015-5844 CVE-2015-5843 CVE-2015-5842
                   CVE-2015-5841 CVE-2015-5840 CVE-2015-5839
                   CVE-2015-5838 CVE-2015-5837 CVE-2015-5835
                   CVE-2015-5834 CVE-2015-5832 CVE-2015-5831
                   CVE-2015-5829 CVE-2015-5827 CVE-2015-5826
                   CVE-2015-5825 CVE-2015-5824 CVE-2015-5823
                   CVE-2015-5822 CVE-2015-5821 CVE-2015-5820
                   CVE-2015-5819 CVE-2015-5818 CVE-2015-5817
                   CVE-2015-5816 CVE-2015-5814 CVE-2015-5813
                   CVE-2015-5812 CVE-2015-5811 CVE-2015-5810
                   CVE-2015-5809 CVE-2015-5807 CVE-2015-5806
                   CVE-2015-5805 CVE-2015-5804 CVE-2015-5803
                   CVE-2015-5802 CVE-2015-5801 CVE-2015-5800
                   CVE-2015-5799 CVE-2015-5797 CVE-2015-5796
                   CVE-2015-5795 CVE-2015-5794 CVE-2015-5793
                   CVE-2015-5792 CVE-2015-5791 CVE-2015-5790
                   CVE-2015-5789 CVE-2015-5788 CVE-2015-5767
                   CVE-2015-5765 CVE-2015-5764 CVE-2015-5748
                   CVE-2015-5523 CVE-2015-5522 CVE-2015-3801
                   CVE-2015-1205 CVE-2015-1129 CVE-2015-0287
                   CVE-2015-0286 CVE-2014-8611 CVE-2014-8146
                   CVE-2013-3951  

Reference:         ASB-2015.0070
                   ASB-2015.0044
                   ASB-2015.0027
                   ASB-2015.0011
                   ESB-2015.0680.2
                   ESB-2015.0678
                   ESB-2014.2348

Original Bulletin: 
   https://support.apple.com/kb/HT201222

- --------------------------BEGIN INCLUDED TEXT--------------------

APPLE-SA-2015-09-16-1 iOS 9

iOS 9 is now available and addresses the following:

Apple Pay
Available for:  iPhone 6, iPad mini 3, and iPad Air 2
Impact:  Some cards may allow a terminal to retrieve limited recent
transaction information when making a payment
Description:  The transaction log functionality was enabled in
certain configurations. This issue was addressed by removing the
transaction log functionality.
CVE-ID
CVE-2015-5916

AppleKeyStore
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local attacker may be able to reset failed passcode
attempts with an iOS backup
Description:  An issue existed in resetting failed passcode attempts
with a backup of the iOS device. This was addressed through improved
passcode failure logic.
CVE-ID
CVE-2015-5850 : an anonymous researcher

Application Store
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Clicking a malicious ITMS link may lead to a denial of
service in an enterprise-signed application
Description:  An issue existed with installation through ITMS links.
This was addressed through additional installation verification.
CVE-ID
CVE-2015-5856 : Zhaofeng Chen, Hui Xue, and Tao (Lenx) Wei of
FireEye, Inc.

Audio
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Playing a malicious audio file may lead to an unexpected
application termination
Description:  A memory corruption issue existed in the handling of
audio files. This issue issue was addressed through improved memory
handling.
CVE-ID
CVE-2015-5862 : YoungJin Yoon of Information Security Lab. (Adv.:
Prof. Taekyoung Kwon), Yonsei University, Seoul, Korea

Certificate Trust Policy
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Update to the certificate trust policy
Description:  The certificate trust policy was updated. The complete
list of certificates may be viewed at https://support.apple.com/en-
us/HT204132.

CFNetwork
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A person with physical access to an iOS device may read
cache data from Apple apps
Description:  Cache data was encrypted with a key protected only by
the hardware UID. This issue was addressed by encrypting the cache
data with a key protected by the hardware UID and the user's
passcode.
CVE-ID
CVE-2015-5898 : Andreas Kurtz of NESO Security Labs

CFNetwork Cookies
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker in a privileged network position can track a
user's activity
Description:  A cross-domain cookie issue existed in the handling of
top level domains. The issue was address through improved
restrictions of cookie creation.
CVE-ID
CVE-2015-5885 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua
University

CFNetwork Cookies
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker may be able to create unintended cookies for a
website
Description:  WebKit would accept multiple cookies to be set in the
document.cookie API. This issue was addressed through improved
parsing.
CVE-ID
CVE-2015-3801 : Erling Ellingsen of Facebook

CFNetwork FTPProtocol
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Malicious FTP servers may be able to cause the client to
perform reconnaissance on other hosts
Description:  An issue existed in FTP packet handling if clients were
using an FTP proxy.
CVE-ID
CVE-2015-5912 : Amit Klein

CFNetwork HTTPProtocol
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A maliciously crafted URL may be able to bypass HTTP Strict
Transport Security (HSTS) and leak sensitive data
Description:  A URL parsing vulnerability existed in HSTS handling.
This issue was addressed through improved URL parsing.
CVE-ID
CVE-2015-5858 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua
University

CFNetwork HTTPProtocol
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious website may be able to track users in Safari
private browsing mode
Description:  An issue existed in the handling of HSTS state in
Safari private browsing mode. This issue was addressed through
improved state handling.
CVE-ID
CVE-2015-5860 : Sam Greenhalgh of RadicalResearch Ltd

CFNetwork Proxies
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Connecting to a malicious web proxy may set malicious
cookies for a website
Description:  An issue existed in the handling of proxy connect
responses. This issue was addressed by removing the set-cookie header
while parsing the connect response.
CVE-ID
CVE-2015-5841 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua
University

CFNetwork SSL
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker with a privileged network position may intercept
SSL/TLS connections
Description:  A certificate validation issue existed in NSURL when a
certificate changed. This issue was addressed through improved
certificate validation.
CVE-ID
CVE-2015-5824 : Timothy J. Wood of The Omni Group

CFNetwork SSL
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker may be able to decrypt data protected by SSL
Description:  There are known attacks on the confidentiality of RC4.
An attacker could force the use of RC4, even if the server preferred
better ciphers, by blocking TLS 1.0 and higher connections until
CFNetwork tried SSL 3.0, which only allows RC4. This issue was
addressed by removing the fallback to SSL 3.0.

CoreAnimation
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious application may be able to leak sensitive user
information
Description:  Applications could access the screen framebuffer while
they were in the background. This issue was addressed with improved
access control on IOSurfaces.
CVE-ID
CVE-2015-5880 : Jin Han, Su Mon Kywe, Qiang Yan, Robert Deng, Debin
Gao, Yingjiu Li of School of Information Systems Singapore Management
University,  Feng Bao and Jianying Zhou of Cryptography and Security
Department Institute for Infocomm Research

CoreCrypto
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker may be able to determine a private key
Description:  By observing many signing or decryption attempts, an
attacker may have been able to determine the RSA private key. This
issue was addressed using improved encryption algorithms.

CoreText
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Processing a maliciously crafted font file may lead to
arbitrary code execution
Description:  A memory corruption issue existed in the processing of
font files. This issue was addressed through improved input
validation.
CVE-ID
CVE-2015-5874 : John Villamil (@day6reak), Yahoo Pentest Team

Data Detectors Engine
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Processing a maliciously crafted text file may lead to
arbitrary code execution
Description:  Memory corruption issues existed in the processing of
text files. These issues were addressed through improved bounds
checking.
CVE-ID
CVE-2015-5829 : M1x7e1 of Safeye Team (www.safeye.org)

Dev Tools
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious application may be able to execute arbitrary
code with system privileges
Description:  A memory corruption issue existed in dyld. This was
addressed through improved memory handling.
CVE-ID
CVE-2015-5876 : beist of grayhash

dyld
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An application may be able to bypass code signing
Description:  An issue existed with validation of the code signature
of executables. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2015-5839 : @PanguTeam, TaiG Jailbreak Team

Disk Images
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to execute arbitrary code with
system privileges
Description:  A memory corruption issue existed in DiskImages. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5847 : Filippo Bigarella, Luca Todesco

Game Center
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious Game Center application may be able to access a
player's email address
Description:  An issue existed in Game Center in the handling of a
player's email. This issue was addressed through improved access
restrictions.
CVE-ID
CVE-2015-5855 : Nasser Alnasser

ICU
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Multiple vulnerabilities in ICU
Description:  Multiple vulnerabilities existed in ICU versions prior
to 53.1.0. These issues were addressed by updating ICU to version
55.1.
CVE-ID
CVE-2014-8146
CVE-2015-1205

IOAcceleratorFamily
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious application may be able to determine kernel
memory layout
Description:  An issue existed that led to the disclosure of kernel
memory content. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2015-5834 : Cererdlong of Alibaba Mobile Security Team

IOAcceleratorFamily
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to execute arbitrary code with
system privileges
Description:  A memory corruption issue existed in
IOAcceleratorFamily. This issue was addressed through improved memory
handling.
CVE-ID
CVE-2015-5848 : Filippo Bigarella

IOHIDFamily
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious application may be able to execute arbitrary
code with system privileges
Description:  A memory corruption issue existed in IOHIDFamily. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5867 : moony li of Trend Micro

IOKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious application may be able to execute arbitrary
code with system privileges
Description:  A memory corruption issue existed in the kernel. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5844 : Filippo Bigarella
CVE-2015-5845 : Filippo Bigarella
CVE-2015-5846 : Filippo Bigarella

IOMobileFrameBuffer
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to execute arbitrary code with
system privileges
Description:  A memory corruption issue existed in
IOMobileFrameBuffer. This issue was addressed through improved memory
handling.
CVE-ID
CVE-2015-5843 : Filippo Bigarella

IOStorageFamily
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local attacker may be able to read kernel memory
Description:  A memory initialization issue existed in the kernel.
This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5863 : Ilja van Sprundel of IOActive

iTunes Store
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  AppleID credentials may persist in the keychain after sign
out
Description:  An issue existed in keychain deletion. This issue was
addressed through improved account cleanup.
CVE-ID
CVE-2015-5832 : Kasif Dekel from Check Point Software Technologies

JavaScriptCore
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Visiting a maliciously crafted website may lead to arbitrary
code execution
Description:  Memory corruption issues existed in WebKit. These
issues were addressed through improved memory handling.
CVE-ID
CVE-2015-5791 : Apple
CVE-2015-5793 : Apple
CVE-2015-5814 : Apple
CVE-2015-5816 : Apple
CVE-2015-5822 : Mark S. Miller of Google
CVE-2015-5823 : Apple

Kernel
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to execute arbitrary code with
kernel privileges
Description:  A memory corruption issue existed in the kernel. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5868 : Cererdlong of Alibaba Mobile Security Team
CVE-2015-5896 : Maxime Villard of m00nbsd
CVE-2015-5903 : CESG

Kernel
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local attacker may control the value of stack cookies
Description:  Multiple weaknesses existed in the generation of user
space stack cookies. This was addressed through improved generation
of stack cookies.
CVE-ID
CVE-2013-3951 : Stefan Esser

Kernel
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local process can modify other processes without
entitlement checks
Description:  An issue existed where root processes using the
processor_set_tasks API were allowed to retrieve the task ports of
other processes. This issue was addressed through added entitlement
checks.
CVE-ID
CVE-2015-5882 : Pedro Vilaca, working from original research by Ming-
chieh Pan and Sung-ting Tsai; Jonathan Levin

Kernel
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker may be able to launch denial of service attacks
on targeted TCP connections without knowing the correct sequence
number
Description:  An issue existed in xnu's validation of TCP packet
headers. This issues was addressed through improved TCP packet header
validation.
CVE-ID
CVE-2015-5879 : Jonathan Looney

Kernel
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker in a local LAN segment may disable IPv6 routing
Description:  An insufficient validation issue existed in handling of
IPv6 router advertisements that allowed an attacker to set the hop
limit to an arbitrary value. This issue was addressed by enforcing a
minimum hop limit.
CVE-ID
CVE-2015-5869 : Dennis Spindel Ljungmark

Kernel
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to determine kernel memory layout
Description:  An issue existed in XNU that led to the disclosure of
kernel memory. This was addressed through improved initialization of
kernel memory structures.
CVE-ID
CVE-2015-5842 : beist of grayhash

Kernel
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to cause a system denial of service
Description:  An issue existed in HFS drive mounting. This was
addressed by additional validation checks.
CVE-ID
CVE-2015-5748 : Maxime Villard of m00nbsd

libc
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to execute arbitrary code with
kernel privileges
Description:  A memory corruption issue existed in the kernel. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2014-8611 : Adrian Chadd and Alfred Perlstein of Norse
Corporation

libpthread
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to execute arbitrary code with
kernel privileges
Description:  A memory corruption issue existed in the kernel. This
issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5899 : Lufeng Li of Qihoo 360 Vulcan Team

Mail
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker can send an email that appears to come from a
contact in the recipient's address book
Description:  An issue existed in the handling of the sender's
address. This issue was addressed through improved validation.
CVE-ID
CVE-2015-5857 : Emre Saglam of salesforce.com

Multipeer Connectivity
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local attacker may be able to observe unprotected
multipeer data
Description:  An issue existed in convenience initializer handling in
which encryption could be actively downgraded to a non-encrypted
session. This issue was addressed by changing the convenience
initializer to require encryption.
CVE-ID
CVE-2015-5851 : Alban Diquet (@nabla_c0d3) of Data Theorem

NetworkExtension
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious application may be able to determine kernel
memory layout
Description:  An uninitialized memory issue in the kernel led to the
disclosure of kernel memory content. This issue was addressed through
memory initialization.
CVE-ID
CVE-2015-5831 : Maxime Villard of m00nbsd

OpenSSL
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Multiple vulnerabilities in OpenSSL
Description:  Multiple vulnerabilities existed in OpenSSL versions
prior to 0.9.8zg. These were addressed by updating OpenSSL to version
0.9.8zg.
CVE-ID
CVE-2015-0286
CVE-2015-0287

PluginKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious enterprise application can install extensions
before the application has been trusted
Description:  An issue existed in the validation of extensions during
installation. This was addressed through improved app verification.
CVE-ID
CVE-2015-5837 : Zhaofeng Chen, Hui Xue, and Tao (Lenx) Wei of
FireEye, Inc.

removefile
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Processing malicious data may lead to unexpected application
termination
Description:  An overflow fault existed in the checkint division
routines. This issue was addressed with improved division routines.
CVE-ID
CVE-2015-5840 : an anonymous researcher

Safari
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local user may be able to read Safari bookmarks on a
locked iOS device without a passcode
Description:  Safari bookmark data was encrypted with a key protected
only by the hardware UID. This issue was addressed by encrypting the
Safari bookmark data with a key protected by the hardware UID and the
user's passcode.
CVE-ID
CVE-2015-5903 : Jonathan Zdziarski

Safari
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Visiting a malicious website may lead to user interface
spoofing
Description:  An issue may have allowed a website to display content
with a URL from a different website. This issue was addressed through
improved URL handling.
CVE-ID
CVE-2015-5904 : Erling Ellingsen of Facebook, Lukasz Pilorz

Safari
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Visiting a malicious website may lead to user interface
spoofing
Description:  Navigating to a malicious website with a malformed
window opener may have allowed the display of arbitrary URLs. This
issue was addressed through improved handling of window openers.
CVE-ID
CVE-2015-5905 : Keita Haga of keitahaga.com

Safari
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Users may be tracked by malicious websites using client
certificates
Description:  An issue existed in Safari's client certificate
matching for SSL authentication. This issue was addressed through
improved matching of valid client certificates.
CVE-ID
CVE-2015-1129 : Stefan Kraus of fluid Operations AG, Sylvain Munaut
of Whatever s.a.

Safari
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Visiting a malicious website may lead to user interface
spoofing
Description:  Multiple user interface inconsistencies may have
allowed a malicious website to display an arbitrary URL. These issues
were addressed through improved URL display logic.
CVE-ID
CVE-2015-5764 : Antonio Sanso (@asanso) of Adobe
CVE-2015-5765 : Ron Masas
CVE-2015-5767 : Krystian Kloskowski via Secunia, Masato Kinugawa

Safari Safe Browsing
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Navigating to the IP address of a known malicious website
may not trigger a security warning
Description:  Safari's Safe Browsing feature did not warn users when
visiting known malicious websites by their IP addresses. The issue
was addressed through improved malicious site detection.
Rahul M of TagsDoc

Security
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious app may be able to intercept communication
between apps
Description:  An issue existed that allowed a malicious app to
intercept URL scheme communication between apps. This was mitigated
by displaying a dialog when a URL scheme is used for the first time.
CVE-ID
CVE-2015-5835 : Teun van Run of FiftyTwoDegreesNorth B.V.; XiaoFeng
Wang of Indiana University, Luyi Xing of Indiana University, Tongxin
Li of Peking University, Tongxin Li of Peking University, Xiaolong
Bai of Tsinghua University

Siri
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A person with physical access to an iOS device may be able
to use Siri to read notifications of content that is set not to be
displayed at the lock screen
Description:  When a request was made to Siri, client side
restrictions were not being checked by the server. This issue was
addressed through improved restriction checking.
CVE-ID
CVE-2015-5892 : Robert S Mozayeni, Joshua Donvito

SpringBoard
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A person with physical access to an iOS device can reply to
an audio message from the lock screen when message previews from the
lock screen are disabled
Description:  A lock screen issue allowed users to reply to audio
messages when message previews were disabled. This issue was
addressed through improved state management.
CVE-ID
CVE-2015-5861 : Daniel Miedema of Meridian Apps

SpringBoard
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious application may be able to spoof another
application's dialog windows
Description:  An access issue existed with privileged API calls. This
issue was addressed through additional restrictions.
CVE-ID
CVE-2015-5838 : Min (Spark) Zheng, Hui Xue, Tao (Lenx) Wei, John C.S.
Lui

SQLite
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Multiple vulnerabilities in SQLite v3.8.5
Description:  Multiple vulnerabilities existed in SQLite v3.8.5.
These issues were addressed by updating SQLite to version 3.8.10.2.
CVE-ID
CVE-2015-5895

tidy
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Visiting a maliciously crafted website may lead to arbitrary
code execution
Description:  A memory corruption issue existed in Tidy. This issues
was addressed through improved memory handling.
CVE-ID
CVE-2015-5522 : Fernando Munoz of NULLGroup.com
CVE-2015-5523 : Fernando Munoz of NULLGroup.com

WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Object references may be leaked between isolated origins on
custom events, message events and pop state events
Description:  An object leak issue broke the isolation boundary
between origins. This issue was addressed through improved isolation
between origins.
CVE-ID
CVE-2015-5827 : Gildas

WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Visiting a maliciously crafted website may lead to arbitrary
code execution
Description:  Memory corruption issues existed in WebKit. These
issues were addressed through improved memory handling.
CVE-ID
CVE-2015-5789 : Apple
CVE-2015-5790 : Apple
CVE-2015-5792 : Apple
CVE-2015-5794 : Apple
CVE-2015-5795 : Apple
CVE-2015-5796 : Apple
CVE-2015-5797 : Apple
CVE-2015-5799 : Apple
CVE-2015-5800 : Apple
CVE-2015-5801 : Apple
CVE-2015-5802 : Apple
CVE-2015-5803 : Apple
CVE-2015-5804 : Apple
CVE-2015-5805
CVE-2015-5806 : Apple
CVE-2015-5807 : Apple
CVE-2015-5809 : Apple
CVE-2015-5810 : Apple
CVE-2015-5811 : Apple
CVE-2015-5812 : Apple
CVE-2015-5813 : Apple
CVE-2015-5817 : Apple
CVE-2015-5818 : Apple
CVE-2015-5819 : Apple
CVE-2015-5821 : Apple

WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Visiting a malicious website may lead to unintended dialing
Description:  An issue existed in handling of tel://, facetime://,
and facetime-audio:// URLs. This issue was addressed through improved
URL handling.
CVE-ID
CVE-2015-5820 : Andrei Neculaesei, Guillaume Ross

WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  QuickType may learn the last character of a password in a
filled-in web form
Description:  An issue existed in WebKit's handling of password input
context. This issue was addressed through improved input context
handling.
CVE-ID
CVE-2015-5906 : Louis Romero of Google Inc.

WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker in a privileged network position may be able to
redirect to a malicious domain
Description:  An issue existed in the handling of resource caches on
sites with invalid certificates. The issue was addressed by rejecting
the application cache of domains with invalid certificates.
CVE-ID
CVE-2015-5907 : Yaoqi Jia of National University of Singapore (NUS)

WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A malicious website may exfiltrate data cross-origin
Description:  Safari allowed cross-origin stylesheets to be loaded
with non-CSS MIME types which could be used for cross-origin data
exfiltration. This issue was addressed by limiting MIME types for
cross-origin stylesheets.
CVE-ID
CVE-2015-5826 : filedescriptor, Chris Evans

WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  The Performance API may allow a malicious website to leak
browsing history, network activity, and mouse movements
Description:  WebKit's Performance API could have allowed a malicious
website to leak browsing history, network activity, and mouse
movements by measuring time. This issue was addressed by limiting
time resolution.
CVE-ID
CVE-2015-5825 : Yossi Oren et al. of Columbia University's Network
Security Lab

WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  An attacker in a privileged network position may be able to
leak sensitive user information
Description:  An issue existed with Content-Disposition headers
containing type attachment. This issue was addressed by disallowing
some functionality for type attachment pages.
CVE-ID
CVE-2015-5921 : Mickey Shkatov of the Intel(r) Advanced Threat
Research Team, Daoyuan Wu of Singapore Management University, Rocky
K. C. Chang of Hong Kong Polytechnic University, Lukasz Pilorz,
superhei of www.knownsec.com

WebKit Canvas
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Visiting a malicious website may disclose image data from
another website
Description:  A cross-origin issue existed with "canvas" element
images in WebKit. This was addressed through improved tracking of
security origins.
CVE-ID
CVE-2015-5788 : Apple

WebKit Page Loading
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  WebSockets may bypass mixed content policy enforcement
Description:  An insufficient policy enforcement issue allowed
WebSockets to load mixed content. This issue was addressed by
extending mixed content policy enforcement to WebSockets.
Kevin G Jones of Higher Logic

Installation note:

This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/

iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.

The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.

To check that the iPhone, iPod touch, or iPad has been updated:

* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "9".

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVfoM+36ZAP0PgtI9AQLV4g/+KPIRwM+mwY6jNT5JHwZiWVjYEmMV7Tla
1Fj+Py8lXkTKTFe1vCtIsPZ/ehrmgcCNuGRVlySP9BdWcGFgFPlv110wkoU8DGRV
xv3NdDxrNbLTQgcQ3Vr2akoQtnZP3SfeQh1DZh2B0Z/p7ZrwdFzSr9PkYv6Q7hxD
pN5PsugDHytG5BZTCTuTlm9iL6nsSQUqJnu1awF6MP7h/o+c9QnEbzcwrPC6aTQJ
UH2AfaGOFjhCY4igqG4bZKXGGYCxSMUCULTxp5VwJ7vQFQzGXbAcnEOr55CzppH3
wmZWyObb7dQQp/hHf5jW1woSCmM5TdIGP/9KzzyG2zBicPE6T+4Lz4lUPZstekFX
Sqd2yO8s+C+J2BBxZIZJ71IECDx87b9RiRebqcujARAzolz5YHVeYgFGbtXpt/3r
Up+JmF5vWismFfUXw5mWroHqqgnOEtB/xNdMc9mvdKZOcn6tuozdF9y3d80Uq8R0
NuqZu6yyTSq8reIgsvPKNaBNfMSNs5F618ZuvlWFav94oxPCo9MXQxTwxUzCnvcg
BUmTQmK2ko8vswdm0sJ4XfVKCK8/Hnq68mC6p/k+D9AEuhlsjjj9fJg07mrqB1de
KFFpeznzkK9kGxr8jBWA8pXPuAO+LsuJX3e0ph8TTvzkMUuOOlKhxQlteiE7GslE
FGuHN/Xjhig=
=zgS9
-----END PGP SIGNATURE-----