iPhone and iPod Touch updated with security patches

Updated 12:05 p.m. PDT Friday to correct where the update is available. It is available through iTunes.

On Friday, Apple released iPhone 2.0 and iPod Touch 2.0 firmware that includes several security fixes for Safari and WebKit. Several of the Safari fixes have been previously issued for Mac OS X and Windows. The update, APPLE-SA-2008-07-11, is only available through iTunes.

This update will not appear in your computer's Software Update application or on the Apple Downloads site. The patches may take up to one week to be detected, depending on the day a device checks. A manual update can be accomplished by using the "Check for Update" button within iTunes.

CFNetwork
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses CVE-2008-0050, a spoofing vulnerability. Apple says " A malicious HTTPS proxy server may return arbitrary data to CFNetwork in a 502 Bad Gateway error, which could allow a secure website to be spoofed. This update addresses the issue by not returning the proxy-supplied data on an error condition."

Kernel
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-0177. Apple explains: "An undetected failure condition exists in the handling of packets with an IPComp header. Sending a maliciously crafted packet to a system configured to use IPSec or IPv6 may cause an unexpected device reset. This update addresses the issue by properly detecting the failure condition."

Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1588. Apple explains: "When Safari displays the current URL in the address bar, Unicode ideographic spaces are rendered. This allows a maliciously crafted website to direct the user to a spoofed site that visually appears to be a legitimate domain. This update addresses the issue by not rendering Unicode ideographic spaces in the address bar."

Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability within CVE-2008-1589. Apple says " When Safari accesses a website that uses a self-signed or invalid certificate, it prompts the user to accept or reject the certificate. If the user presses the menu button while at the prompt, then on the next visit to the site, the certificate is accepted with no prompt. This may lead to the disclosure of sensitive information." Apple credits Hiromitsu Takagi with reporting this vulnerability.

Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the arbitrary code execution vulnerability within CVE-2008-2303. Apple explains "A signedness issue in Safari's handling of JavaScript array indices may result in an out-of-bounds memory access. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript array indices." Apple credits SkyLined of Google for reporting the vulnerability.

Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the cross-site scripting vulnerability details within CVE-2006-2783. Apple explains "Safari ignores Unicode byte order mark sequences when parsing web pages. Certain websites and web content filters attempt to sanitize input by blocking specific HTML tags. This approach to filtering may be bypassed and lead to cross-site scripting when encountering maliciously-crafted HTML tags containing byte order mark sequences. This update addresses the issue through improved handling of byte order mark sequences." Apple credits Chris Weber of Casaba Security for reporting the vulnerability.

Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-2307. Apple says "A memory corruption issue exists in WebKit's handling of JavaScript arrays. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution." Apple credits James Urquhart for reporting the vulnerability.

Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-2317. Apple explains "A memory corruption issue exists in WebCore's handling of style sheet elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved garbage collection." Apple credits Peter Vreudegnhil working with the TippingPoint Zero Day Initiative for reporting the vulnerability.

Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2007-6284. Apple says "A memory consumption issue exists in the handling of XML documents containing invalid UTF-8 sequences, which may lead to a denial of service."

Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1767. Apple says "A memory corruption issue exists in the libxslt library. Viewing a maliciously crafted HTML page may lead to an unexpected application termination or arbitrary code execution." Apple credits Anthony de Almeida Lopes of Outpost24 AB, and Chris Evans of Google Security Team for reporting the vulnerability.

WebKit
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1590. Apple says "A memory corruption issue exists in JavaScriptCore's handling of runtime garbage collection. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution." Apple credits Itzik Kotler and Jonathan Rom of Radware for reporting the vulnerability.

WebKit
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1025. Apple says "An issue exists in WebKit's handling of URLs containing a colon character in the host name. Accessing a maliciously crafted URL may lead to a cross-site scripting attack. This update addresses the issue through improved handling of URLs." Apple credits Robert Swiecki of the Google Security Team, and David Bloom for reporting the vulnerability.

WebKit
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1026. Apple says "A heap buffer overflow exists in WebKit's handling of JavaScript regular expressions. The issue may be triggered via JavaScript when processing regular expressions with large, nested repetition counts. This may lead to an unexpected application termination or arbitrary code execution." Apple credits Charlie Miller of Independent Security Evaluators for reporting the vulnerability.