Multiple security issues and vulnerabilities have been reported in Apple iOS, which can be exploited by malicious people to bypass certain security restrictions, conduct phishing, spoofing, and cross-site scripting attacks, disclose sensitive information, cause a DoS (Denial of Service), or compromise a vulnerable system.

1) An security issue is caused due to the Application Sandbox not properly restricting access to the user's photo library. This can be exploited by a malicious application to determine visited locations without authorisation.

2) An error in the processing of URLs in CFNetwork can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code when a user visits a specially crafted web site.

3) Some vulnerabilities in ImageIO can be exploited by malicious people to disclose potentially sensitive information or potentially compromise a vulnerable system.

For more information see vulnerability #2 through #4 in:
SA38932

4) An unspecified error in ImageIO can be exploited to corrupt memory and potentially execute arbitrary code via a specially crafted JPEG image.

5) An error in Libsystem can potentially be exploited by malicious people to execute arbitrary code.

For more information see vulnerability #30 in:
SA39158

6) Some vulnerabilities in libxml can be exploited by malicious people to cause a DoS (Denial of Service).

For more information:
SA36207

7) An error in Passcode Lock can lead to the passcode already being entered if the device is unlocked in response to an alert, and MobileMe is used to Remote Lock the device.

8) A race condition in Passcode Lock allows pairing with a computer, even if the device is locked.

Successful exploitation requires that the device was unlocked before powering down.

9) An error in Safari allows web sites to set Cookies, even if the "Accept Cookies" preference is set to "From visited" or "Never".

10) A vulnerability in Safari can be exploited by malicious people to conduct phishing attacks.

For more information see vulnerability #2 in:
SA40105

11) A vulnerability in Safari can be exploited by malicious people to conduct spoofing attacks.

For more information see vulnerability #2 in:
SA36096

12) A design error in the Settings application can result in the application incorrectly indicating another wireless network.

13) Multiple vulnerabilities in WebKit can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, disclose sensitive information, or compromise a vulnerable system.

For more information:
SA36269
SA37346
SA37931
SA38932
SA40105
SA40196

14) A use-after-free error in JavaScriptCore during page transitions can be exploited to execute arbitrary code when a user visits a specially crafted web site.

15) An error in WebKit when handling tables can be exploited to trigger an out-of-bounds memory access and potentially execute arbitrary code.

16) An error in WebKit results in the "history.replaceState" method affecting the parent frame, even if it is in a separate origin. This can be exploited to disclose potentially sensitive information.

17) An error in WebKit allows iframes to display content outside of its boundaries. This can be exploited to e.g. spoof the user interface.

Solution
Upgrade to iOS 4 (downloadable and installable via iTunes).

Provided and/or discovered by
The vendor credits:
1) Zac White
2) Laurent OUDOT of TEHTRI-Security
4) Ladd Van Tol, Critical Path Software
7) Sidney San Martin of DeepTech, Inc.
9) Jason Dent, Street Side Software
12) Wilfried Teiken
15) wushi of team509
16) Darin Fisher, Google Inc.
17) Wayne Pan of AdMob, Inc.

Original Advisory
Apple:
http://support.apple.com/kb/HT4225

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area