Apple on Tuesday released an iPhone and iPod Touch security update to close five vulnerabilities, some of which could allow hackers to launch malicious code.
iPhone operating system version 3.1.3, which also is installed on the iPod Touch, closes dangerous flaws in CoreAudio, ImageIO and WebKit that could permit arbitrary code execution, according to an advisory.
In the case of CoreAudio, malware could be loaded onto a device if a user is tricked into playing a maliciously crafted MP4 audio file, the advisory said. The ImageIO bug allows malware to be installed if a user views a maliciously crafted TIFF image.
There are two bugs in WebKit, Mac's web browser engine. One involves an input validation issue and can lead to remote attacks if a user accesses a maliciously crafted FTP server, Apple said. The other, less severe flaw could be exploited to cause the device's inbox to load remote audio and video content when remote image loading is disabled.
Finally, the update filled a memory corruption hole in Recovery Mode that could have permitted a person with physical access to a locked device the ability to access data, the advisory said.
