For users of Iphone and Ipad, a new ios 8 update is now available that actually bring a host of enhancement and patches. The long list of change log show that this update is currently the biggest yet to date. The security patch alone is more than the whole security patch for both ios 7 to ios 8.2 and that would means bad news for those jail breakers. It will be a while before any Jail break would be available for this version.
Biggest change in place is the new racially diverse emoji available now giving more segments of users their own more personalized emoji icon. There is even a secret emoji that give homage to the late Leonard Nimroy that passed away earlier this year. This is a great tribute to the original Mr. Spock where almost every person in the world can now share the "Vulcan salute"
If you own any of apple device with ios 8.3, you can use the "vulcan salute" by folowing instructions on the CNET http://www.cnet.com/au/how-to/unlock-the-secret-spock-emoji-in-ios-8-3/.
Below is the change log for this 8.3 update. (fix and additional items) and this major patch would means any jail break for 8.3 would not be available any time soon.
This release includes improved performance, bug fixes, and a redesigned Emoji keyboard. Changes include:
Improved performance for:
• App launch
• App responsiveness
• Messages
• Wi-Fi
• Control Center
• Safari tabs
• 3rd-party keyboards
• Keyboard shortcuts
• Simplified Chinese keyboard
Wi-Fi and Bluetooth fixes
• Fixes an issue where you could be continuously prompted for login credentials
• Addresses an issue where some devices disconnect intermittently from Wi-Fi networks
• Fixes an issue where hands-free phone calls could become disconnected
• Fixes an issue where audio playback could stop working with some bluetooth speakers
Orientation and rotation fixes
• Addresses an issue that sometimes prevented rotating back to portrait after having rotated to landscape
• Improves performance and stability issues that occurred when rotating the device between portrait and landscape
• Fixes an issue where device orientation appeared upside down after pulling the iPhone 6 Plus from your pocket
• Resolves an issue that sometimes prevented apps from rotating to correct orientation after switching apps in multitasking
Messages fixes
• Address issues that caused group messages to sometimes split
• Fixes an issue that sometimes removed the ability to forward or delete individual messages
• Resolves an issue that sometimes prevented a preview from appearing when taking a photo in Messages
• Adds the ability to report junk messages directly from the Messages app
• Adds the ability to filter out iMessages that are not sent by your contacts
Family Sharing fixes
• Fixes a bug where certain apps would not launch or update on family members’ devices
• Fixes a bug that prevented family members from downloading certain free apps
• Increased reliability for Ask to Buy notifications
CarPlay fixes
• Fixes an issue where Maps could come up as a black screen
• Fixes an issue where the UI could be incorrectly rotated
• Fixes an issue where the keyboard could appear on the CarPlay screen when it shouldn't
Enterprise fixes
• Improves reliability of installing and updating enterprise apps
• Corrects the time zone of Calendar events created in IBM Notes
• Fixes a problem that could cause web clip icons to become generic after restarting
• Improves reliability of saving the password for a web proxy
• Exchange out-of-office message can now be edited separately for external replies
• Improves recovery of Exchange accounts from temporary connection problems
• Improves compatibility of VPN and web proxy solutions
• Allows use of physical keyboards to log into Safari web sheets, such as for joining a public Wi-FI network
• Fixes an issue that caused Exchange meetings with long notes to be truncated
Accessibility fixes
• Fixes an issue where using the back button in Safari causes VoiceOver gestures to not respond
• Fixes an issue where VoiceOver focus becomes unreliable in draft Mail messages
• Fixes an issue where Braille Screen Input cannot be used to type text in forms on webpages
• Fixes an issue where toggling Quick Nav on a Braille Display announces that Quick Nav is off
• Fixes issue keeping app icons from being moveable on home screen when VoiceOver is enabled
• Fixes an issue in Speak Screen where speech will not start again after pausing
Other improvements and bug fixes
• Introduces a redesigned Emoji keyboard with over 300 new characters
• iCloud Photo Library has been optimized to work with the new Photos app on OS X 10.10.3 and is now out of beta
• Improves the pronunciation of street names during turn-by-turn navigation in Maps
• Includes support for Baum VarioUltra 20 and VarioUltra 40 braille displays
• Improves the display of Spotlight results when Reduce Transparency is turned on
• Adds Italic and Underline format options for iPhone 6 Plus landscape keyboard
• Adds the ability to remove shipping and billing addresses used with Apple Pay
• Additional language and country support for Siri: English (India, New Zealand), Danish (Denmark), Dutch (Netherlands), Portuguese (Brazil), Russian (Russia), Swedish (Sweden), Thai (Thailand), Turkish (Turkey)
• Additional dictation languages: Arabic (Saudi Arabia, United Arab Emirates) and Hebrew (Israel)
• Improves stability for Phone, Mail, Bluetooth connectivity, Photos, Safari tabs, Settings, Weather and Genius Playlists in Music
• Address an issue where Slide to Unlock could fail to work on certain devices
• Addresses an issue that sometimes prevented swiping to answer a phone call on the Lock screen
• Addresses an issue that prevented opening links in Safari PDFs
• Fixes an issue where selecting Clear History and Website Data in Safari Settings did not clear all data
• Fixes an issue that prevented autocorrecting "FYI"
• Addresses an issue where contextual predictions did not appear in Quick Reply
• Fixes an issue where Maps did not enter night mode from hybrid mode
• Resolves an issue that prevented initiating FaceTime calls from a browser or 3rd-party app using FaceTime URLs
• Fixes an issue that sometimes prevented photos from properly exporting to Digital Camera Image folders on Windows
• Fixes an issue that sometimes prevented an iPad backup from completing with iTunes
• Fixes an issue that could cause Podcast downloads to stall when switching from Wi-Fi to cellular networks
• Fixes an issue where remaining time on timer would sometimes incorrectly display as 00:00 on Lock screen
• Fixes an issue that sometimes prevented adjusting call volume
• Fixes an issues that caused the status bar to sometimes appear when it shouldn’t
Change log for Security:
AppleKeyStore
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to guess the user's passcode
Description: iOS allowed access to an interface which allowed attempts to confirm the user's passcode. This issue was addressed with improved entitlement checking.
CVE-ID
CVE-2015-1085
Audio Drivers
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A validation issue existed in IOKit objects used by an audio driver. This issue was addressed through improved validation of metadata.
CVE-ID
CVE-2015-1086
Backup
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker may be able to use the backup system to access restricted areas of the file system
Description: An issue existed in the relative path evaluation logic of the backup system. This issues was addressed through improved path evaluation.
CVE-ID
CVE-2015-1087 : TaiG Jailbreak Team
Certificate Trust Policy
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Update to the certificate trust policy
Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/kb/HT204132
CFNetwork
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Cookies belonging to one origin may be sent to another origin
Description: A cross-domain cookie issue existed in redirect handling. Cookies set in a redirect response could be passed on to a redirect target belonging to another origin. The issue was address through improved handling of redirects.
CVE-ID
CVE-2015-1089 : Niklas Keller
CFNetwork
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A user may be unable to fully delete browsing history
Description: Clearing Safari's history did not clear saved HTTP Strict Transport Security state. The issue was addressed through improved data deletion.
CVE-ID
CVE-2015-1090
CFNetwork Session
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Authentication credentials may be sent to a server on another origin
Description: A cross-domain HTTP request headers issue existed in redirect handling. HTTP request headers sent in a redirect response could be passed on to another origin. The issue was addressed through improved handling of redirects.
CVE-ID
CVE-2015-1091 : Diego Torres (http://dtorres.me)
CFURL
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: An input validation issue existed within URL processing. This issue was addressed through improved URL validation.
CVE-ID
CVE-2015-1088
Foundation
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An application using NSXMLParser may be misused to disclose information
Description: An XML External Entity issue existed in NSXMLParser's handling of XML. This issue was addressed by not loading external entities across origins.
CVE-ID
CVE-2015-1092 : Ikuya Fukumoto
FontParser
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: Multiple memory corruption issues existed in the processing of font files. These issues were addressed through improved bounds checking.
CVE-ID
CVE-2015-1093 : Marc Schoenefeld
IOAcceleratorFamily
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to determine kernel memory layout
Description: An issue existed in IOAcceleratorFamily that led to the disclosure of kernel memory content. This issue was addressed by removing unneeded code.
CVE-ID
CVE-2015-1094 : Cererdlong of Alibaba Mobile Security Team
IOHIDFamily
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious HID device may be able to cause arbitrary code execution
Description: A memory corruption issue existed in an IOHIDFamily API. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-1095 : Andrew Church
IOHIDFamily
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to determine kernel memory layout
Description: An issue existed in IOHIDFamily that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2015-1096 : Ilja van Sprundel of IOActive
IOMobileFramebuffer
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to determine kernel memory layout
Description: An issue existed in MobileFrameBuffer that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2015-1097 : Barak Gabai of the IBM X-Force Application Security Research Team
iWork Viewer
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Opening a maliciously crafted iWork file may lead to arbitrary code execution
Description: A memory corruption issue existed in the handling of iWork files. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-1098 : Christopher Hickstein
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to cause a system denial of service
Description: A race condition existed in the kernel's setreuid system call. This issue was addressed through improved state management.
CVE-ID
CVE-2015-1099 : Mark Mentovai of Google Inc.
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may escalate privileges using a compromised service intended to run with reduced privileges
Description: setreuid and setregid system calls failed to drop privileges permanently. This issue was addressed by correctly dropping privileges.
CVE-ID
CVE-2015-1117 : Mark Mentovai of Google Inc.
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to cause unexpected system termination or read kernel memory
Description: A out of bounds memory access issue existed in the kernel. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-1100 : Maxime Villard of m00nbsd
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.
CVE-ID
CVE-2015-1101 : lokihardt@ASRT working with HP's Zero Day Initiative
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may be able to cause a denial of service
Description: A state inconsistency existed in the processing of TCP headers. This issue was addressed through improved state handling.
CVE-ID
CVE-2015-1102 : Andrey Khudyakov and Maxim Zhuravlev of Kaspersky Lab
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may be able to redirect user traffic to arbitrary hosts
Description: ICMP redirects were enabled by default on iOS. This issue was addressed by disabling ICMP redirects.
CVE-ID
CVE-2015-1103 : Zimperium Mobile Security Labs
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A remote attacker may be able to bypass network filters
Description: The system would treat some IPv6 packets from remote network interfaces as local packets. The issue was addressed by rejecting these packets.
CVE-ID
CVE-2015-1104 : Stephen Roettger of the Google Security Team
Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A remote attacker may be able to cause a denial of service
Description: A state inconsistency issue existed in the handling of TCP out of band data. This issue was addressed through improved state management.
CVE-ID
CVE-2015-1105 : Kenton Varda of Sandstorm.io
Keyboards
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: QuickType could learn users' passcodes
Description: When using Bluetooth keyboards, QuickType could learn users' passcodes. This issue was addressed by preventing QuickType from being displayed on the lockscreen.
CVE-ID
CVE-2015-1106 : Jarrod Dwenger, Steve Favorito, Paul Reedy of ConocoPhillips, Pedro Tavares of Molecular Biophysics at UCIBIO/FCT/UNL, De Paul Sunny, Christian Still of Evolve Media, Canada
libnetcore
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Processing a maliciously crafted configuration profile may lead to unexpected application termination
Description: A memory corruption issue existed in the handling of configuration profiles. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2015-1118 : Zhaofeng Chen, Hui Xue, Yulong Zhang, and Tao Wei of FireEye, Inc.
Lock Screen
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker in possession of a device may prevent erasing the device after failed passcode attempts
Description: In some circumstances, a device might not erase itself after failed passcode attempts. This issue was addressed through additional enforcement of erasure.
CVE-ID
CVE-2015-1107 : Brent Erickson, Stuart Ryan of University of Technology, Sydney
Lock Screen
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker in possession of a device may exceed the maximum number of failed passcode attempts
Description: In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit.
CVE-ID
CVE-2015-1108
NetworkExtension
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker in possession of a device may be able to recover VPN credentials
Description: An issue existed in the handling of VPN configuration logs. This issue was addressed by removing logging of credentials.
CVE-ID
CVE-2015-1109 : Josh Tway of IPVanish
Podcasts
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Unnecessary information may be sent to external servers when downloading podcast assets
Description: When downloading assets for podcast a user was subscribed to, unique identifiers were sent to external servers. This issue was resolved by removing these identifiers.
CVE-ID
CVE-2015-1110 : Alex Selivanov
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A user may be unable to fully delete browsing history
Description: Clearing Safari's history did not clear "Recently closed tabs". The issue was addressed through improved data deletion.
CVE-ID
CVE-2015-1111 : Frode Moe of LastFriday.no
Safari
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Users' browsing history may not be completely purged
Description: A state management issue existed in Safari that resulted in users' browsing history not being purged from history.plist. This issue was addressed by improved state management.
CVE-ID
CVE-2015-1112 : William Breuer, The Netherlands
Sandbox Profiles
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to access phone numbers or email addresses of recent contacts
Description: An information disclosure issue existed in the third-party app sandbox. This issue was addressed by improving the sandbox profile.
CVE-ID
CVE-2015-1113 : Andreas Kurtz of NESO Security Labs, Markus Troßbach of Heilbronn University
Sandbox Profiles
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Hardware identifiers may be accessible by third-party apps
Description: An information disclosure issue existed in the third-party app sandbox. This issue was addressed by improving the sandbox profile.
CVE-ID
CVE-2015-1114
Telephony
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to access restricted telephony functions
Description: An access control issue existed in the telephony subsystem. Sandboxed apps could access restricted telephony functions. This issue was addressed with improved entitlement checking.
CVE-ID
CVE-2015-1115 : Andreas Kurtz of NESO Security Labs, Markus Troßbach of Heilbronn University
UIKit View
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Sensitive data may be exposed in application snapshots presented in the Task Switcher
Description: An issue existed in UIKit, which did not blur application snapshots containing sensitive data in the Task Switcher. This issue was addressed by correctly blurring the snapshot.
CVE-ID
CVE-2015-1116 : The mobile app team at HP Security Voltage, Aaron Rogers of Mint.com, David Edwards of Tech4Tomorrow, David Zhang of Dropbox
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Inconsistent user interface may prevent users from discerning a phishing attack
Description: A user interface inconsistency existed in Safari that allowed an attacker to misrepresent the URL. This issue was addressed through improved user interface consistency checks.
CVE-ID
CVE-2015-1084 : Apple
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
CVE-ID
CVE-2015-1068 : Apple
CVE-2015-1069 : lokihardt@ASRT working with HP's Zero Day Initiative
CVE-2015-1070 : Apple
CVE-2015-1071 : Apple
CVE-2015-1072
CVE-2015-1073 : Apple
CVE-2015-1074 : Apple
CVE-2015-1076
CVE-2015-1077 : Apple
CVE-2015-1078 : Apple
CVE-2015-1079 : Apple
CVE-2015-1080 : Apple
CVE-2015-1081 : Apple
CVE-2015-1082 : Apple
CVE-2015-1083 : Apple
CVE-2015-1119 : Renata Hodovan of University of Szeged / Samsung Electronics
CVE-2015-1120 : Apple
CVE-2015-1121 : Apple
CVE-2015-1122 : Apple
CVE-2015-1123 : Randy Luecke and Anoop Menon of Google Inc.
CVE-2015-1124 : Apple
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a user invoking a click on another website
Description: An issue existed when handling touch events. A tap could propagate to another website. The issue was addressed through improved event handling.
CVE-ID
CVE-2015-1125 : Phillip Moon and Matt Weston of www.sandfield.co.nz
WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to resources of another origin being accessed
Description: An issue existed in WebKit when handling credentials in FTP URLs. This issue was address through improved decoding.
CVE-ID
CVE-2015-1126 : Jouko Pynnonen of Klikki Oy
No comments:
Post a Comment