Apple Fixes Serious Flaws in iOS 5.1.1

Apple has patched several serious security bugs in iOS with the release of version 5.1.1 of the mobile operating system. The most serious of the security vulnerabilities could be used for remote code execution.

The highest severity vulnerability that’s fixed in iOS 5.1.1 is a WebKit flaw that can lead to remote code execution or an application crashing. In order to trigger that vulnerability, a user would need to visit a Web site with a maliciously crafted URL, which is a common attack tactic via phishing emails and URL redirections.

There is a second WebKit flaw that’s fixed in this release of iOS, as well. This one was used as part of Google’s Pwnium contest at CanSecWest in March by security researcher Sergey Glazunov. It’s less severe than the first WebKit flaw, and can only lead to a cross-site scripting attack.

The third vulnerability fixed in this release of iOS is a URL-spoofing bug in Safari.

“A URL spoofing issue existed in Safari. This could be used in a malicious web site to direct the user to a spoofed site that visually appeared to be a legitimate domain. This issue is addressed through improved URL handling. This issue does not affect OS X systems,” Apple said in its advisory.

The new version of iOS is available for iPhones, iPads and iPod Touch devices.