Product:
iOS
Summary
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service through a crafted app. This vulnerability can lead to significant security risks, including complete compromise of confidentiality, integrity, and availability. Users are advised to update their devices to mitigate these risks.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2016-4656 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious application that, when executed on a vulnerable device, can execute arbitrary code with elevated privileges. This can be done remotely over a network, requiring no authentication, making it particularly dangerous. User interaction is required to install and run the malicious app, which can lead to severe consequences for the device’s security.
Affected Products
- iOS versions prior to 9.3.5 – Vulnerable to arbitrary code execution and denial of service.
Mitigation
Users should apply updates as per vendor instructions to ensure their devices are protected against this vulnerability. Keeping the operating system up to date is crucial for maintaining security.