iOS 8.1.1 Brings Bug Fixes; Improved Performance for iPhone 4S and iPad 2

Apple released iOS 8.1.1 update on Monday for all devices that support (or are running) iOS 8. The update brings miscellaneous bug fixes and security updates, with iPhone 4S and iPad 2 - two devices that bore the brunt of the iOS 8 update in terms of slowdown in performance - especially called out in the release notes.

"This release includes bug fixes, increased stability and performance improvements for iPad 2 and iPhone 4s," Apple says.

The OTA update weighs in at 43.1MB for the iPhone 4S, and around 64MB for iPhone 6 (Review | Pictures). We strongly recommend you back up your iOS device to iCloud or with iTunes before installing any iOS update.

(Also see: How to Upgrade to iOS 8 When It Cannot Be Installed Because It Requires GBs of Storage)

The update also includes the following security updates:

CFNetwork
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later

Impact: Website cache may not be fully cleared after leaving private browsing

Description: A privacy issue existed where browsing data could remain in the cache after leaving private browsing. This issue was addressed through a change in caching behavior.

CVE-ID

CVE-2014-4460

dyld
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later

Impact: A local user may be able to execute unsigned code

Description: A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed through improved validation of segment sizes.

CVE-ID

CVE-2014-4455 : @PanguTeam

Kernel
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: A validation issue existed in the handling of certain metadata fields of IOSharedDataQueue objects. This issue was addressed through relocation of the metadata.

CVE-ID

CVE-2014-4461 : @PanguTeam

Lock Screen
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later

Impact: An attacker in possession of a device may exceed the maximum number of failed passcode attempts

Description: In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit.

CVE-ID

CVE-2014-4451 : Stuart Ryan of University of Technology, Sydney

Lock Screen
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later

Impact: A person with physical access to the phone may be able to access photos in the Photo Library

Description: The Leave a Message option in FaceTime may have allowed viewing and sending photos from the device. This issue was addressed through improved state management.

CVE-ID

CVE-2014-4463

Sandbox Profiles
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later

Impact: A malicious application may be able to launch arbitrary binaries on a trusted device

Description: A permissions issue existed with the debugging functionality for iOS that allowed the spawning of applications on trusted devices that were not being debugged. This was addressed by changes to debugserver's sandbox.

CVE-ID

CVE-2014-4457 : @PanguTeam

Spotlight
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later

Impact: Unnecessary information is included as part of the initial connection between Spotlight or Safari and the Spotlight Suggestions servers

Description: The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user's approximate location before a user entered a query. This issue was addressed by removing this information from the initial connection and only sending the user's approximate location as part of queries.

CVE-ID

CVE-2014-4453 : Ashkan Soltani

WebKit
Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.

CVE-ID

CVE-2014-4452

CVE-2014-4462