Apple has released updates to address flaws in its Safari 6 web browser and iOS 6 mobile operating system.
The fixes were made available last week and address two vulnerabilities in Safari 6.0.2.
The bugs, which lie in the open source WebKit web browser engine, could allow for “unexpected application termination or arbitrary code execution” if users visited a malicious website, according to Apple's summary of the flaws.
The browser update affects the OS X Lion and OS X Mountain Lion operating systems.
Updates for iOS 6.0.1 affecting iPhone 3GS, iPad 2 and the fourth-generation iPod Touch also addressed the same vulnerabilities, but for mobile users.
Other patches in iOS addressed a data disclosure bug, which could allow “maliciously crafted or compromised iOS applications” to determine addresses in the kernel, and a passcode-lock security issue, which could potentially allow attackers to bypass password requirements for Passbook – an iOS app that can store users' airline boarding passes, coupons, movie tickets, retailer reward cards and other mobile payment information.
Qualys CTO Wolfgang Kandek said the WebKit bugs represented the most widespread threat to users.
“When you use Safari or Google Chrome, for instance, you are using WebKit as its underpinning,” Kandek said. “The attacks would be through a website that has something malicious on there that knows about the vulnerability, and it could run something on your machine that wants to take control of it. You probably wouldn't even notice [malware] that had been installed on your machine, which could feed information to an attacker.”
Sophos senior security advisor Chester Wisniewski said the WebKit fix appeared most critical.
“From a critical standpoint, I'd rate the WebKit issues highest because they affect Safari, Google Chrome and mobile users – and allow attackers to launch a drive-by exploit, which are most likely to be used by an attacker.”
