Apple on Tuesday evening addressed concerns about potentially dangerous defense holes in the mobile version of its Safari web browser with the first ever software update to its new iPhone handset.
Targeting vulnerabilities that could be exploited through malicious websites, version 1.0.1 (build 1C25) of the handset’s software updates Safari’s JavaScript handling to prevent cross-site scripting and a buffer overflow in the Perl cipher library.
The latter scripting flaw was heavily publicized last week when consultants from Independent protection Evaluators used it to effectively hijack the phone’s core functions.
Also addressed by software patch were three separate issues within the company’s WebCore and WebKit platforms that profile the spine of Safari. Two of the fixes guard against false XML requests and frame rendering glitches that could be used to control the phone or crash the browser through memory errors.
Like recent iPod updates, the iPhone fix is downloadable solely through iTunes and can be installed the next moment the phone is docked or detected by the jukebox software.
In a brief set of release notes, Apple said the iPhone software update additionally includes several “iPhone bug fixes.” The company recommends that users install the patch “immediately.”
More...
04-18-2008, 11:51 AM
Linear Mode
Similar Threads