|
|
Two of the flaws addressed concern problems that can be exploited by maliciously crafted media files, with the possibility of arbitrary code execution. MP4 audio file handling had the possibility of a buffer overflow, while TIFF images could trigger a buffer underflow.
Both of these issues have been addressed through better bounds checking.
Flaws in the way iPhone OS parses FTP directory listings meant that a maliciously crafted FTP server could potentially extract information from the device, cause the application to crash, or execute arbitrary code.
You know the way a passcode can be set to lock an iPhone? Apple determined that a certain USB control message could cause memory corruption in such a way that the need to enter the passcode was avoided.
There's also a security issue involving Mail - please read on.
|
|
The problem was that this test wasn't being applied to HTML 5 media elements, so remotely hosted content was downloaded regardless of the user's preference.
Why is that a security problem? One of the tricks used to track whether a particular message has been read is to include a 'web bug' - a usually small and often invisible item that can be used to determine if and when an email was read, the recipient's IP address, and potentially the email address of someone visiting a web site.
Three non-security issues are addressed by the 3.1.3 update.
The accuracy of the battery indicator has been improved on the iPhone 3GS.
A app-crashing bug involving the Japanese Kana keyboard has been fixed.
Please read on for the remaining issues fixed in iPhone OS 3.1.3.
|
|
The iPhone OS 3.1.3 update is compatible with all models of the iPhone and iPod touch.
It is available via the iTunes application on Mac OS X or Windows.
