Apple issues security updates for Safari, iOS

Share this article:

Apple on Wednesday issued security updates for its Safari 5 web browser and iOS mobile operating system to address dozens of vulnerabilities.

An update affecting Safari 5 for Mac and Windows fixes more than 60 flaws and upgrades the web browser to version 5.0.4. The iOS update patches many of the same flaws and brings the mobile operating system, used for iPhones, iPads and the iPod touch devices, to version 4.3.

Unlike most other computing firms, including Microsoft and Adobe, Apple does not assign severity levels to the vulnerabilities discovered in its products.

Many of the flaws are critical, nonetheless, Graham Cluley, senior technology consultant at anti-virus firm Sophos, wrote in a blog post Thursday. As many as 57 of the bugs could be exploited via drive-by download if a user simply visits a malicious website using an unpatched version of Safari.

Most of the flaws in both Safari and iOS were described as memory corruption issues affecting WebKit, the framework used to render web pages, according to Apple's advisories.

Overall, the vulnerabilities could allow an attacker to execute arbitrary code, cause a denial-of-service, obtain sensitive information or conduct cross-site scripting attacks, US-CERT said in an advisory posted Thursday.

“These are, of course, the kind of vulnerabilities that have been exploited by malicious hackers and virus writers in the past and would present a way to deliver code to a non-jailbroken iPhone that did not involve entering via the official iPhone App Store,” Cluley wrote.

The iOS 4.3 update, however, is not available for the iPhone 3G and older versions of the iPod Touch, he warned. The update is only compatible with the iPhone 3GS and later, the third-generation iPod Touch and all versions of the iPad. As a result, earlier iPhone and iPod Touch devices are still vulnerable to attacks that exploit these flaws. 

“If you were looking for an excuse to upgrade your iPhone or iPod touch – maybe you've just been given a good one by Apple,” Cluley wrote.

Meanwhile, Apple on Wednesday also released a security update for Apple TV to address a number of flaws.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

Four men charged with stealing Microsoft and U.S. Army trade secrets

Four men charged with stealing Microsoft and U.S. ...

The young men allegedly used SQL injection and stolen logins to gain access to systems at various companies and steal their intellectual property.

Google bumps maximum Chrome bug bounty reward to $15K

A high-quality report with a functional exploit for a sandbox escape will earn a bug hunter $15,000, according to the new reward amounts.

Survey: orgs adopt hybrid cloud environments despite security concerns

Survey: orgs adopt hybrid cloud environments despite security ...

Despite difficulties and concerns regarding security, more than 60 percent of respondents have adopted or plan to adopt a hybrid cloud environment.