Last month, we reported that a JavaScript bug had been discovered involving Smart App Banners. Apple added the feature in iOS 6 as a way to help developers promote their apps and provide users with a direct link to download them.
Well as it turned out, these Smart Banners were enabling JavaScript in the iOS Settings app without user consent or knowledge. And this was considered to be a fairly serious security threat. But it looks like Apple has fixed it in iOS 6.1…
From Apple’s ‘About the security content of iOS 6.1 Software Update’ page (via AppleInsider):
“Impact: JavaScript may be enabled in Mobile Safari without user interaction
Description: If a user disabled JavaScript in Safari Preferences, visiting a site which displayed a Smart App Banner would re-enable JavaScript without warning the user. This issue was addressed by not enabling JavaScript when visiting a site with a Smart App Banner.”
Credit for the discovery of the JavaScript bug goes to Andrew Plotkin of Zarfhome Software Consulting, Ben Madison of BitCloud, and Marek Durcek. As you may recall, Plotkin posted about the issue on his Google+ page last October.
iOS 6.1 fixed a number of other bugs as well, including one involving memory corruption in Webkit, and a kernel exploit discovered by known iOS hacker Mark Dowd that could allow a user to access the first page of kernel memory.
Apple released the new firmware to the public yesterday morning, just a few days after seeding its 5th beta to the public. The update adds LTE support for more carriers, as well as Siri and iTunes Match improvements. You can download it here.