This is a digest of recent email from Apple sources, RSS and their security
list. Hopefully, you can read the attachments.
You know there’s been a new product released, because they inevitably also
announce a security bugfix. This is, I think, not on the whole a very good
thing, but it’s a helpful reminder, all the same.
--
You received this message because you are subscribed to the Google Groups
"MacVisionaries" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to macvisionaries+unsubscr...@googlegroups.com.
To post to this group, send email to macvisionaries@googlegroups.com.
Visit this group at http://groups.google.com/group/macvisionaries.
For more options, visit https://groups.google.com/d/optout.
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2015-03-09-2 AppleTV 7.1
AppleTV 7.1 is now available and addresses the following:
Apple TV
Available for: Apple TV 3rd generation and later
Impact: An attacker with a privileged network position may intercept
SSL/TLS connections
Description: Secure Transport accepted short ephemeral RSA keys,
usually used only in export-strength RSA cipher suites, on
connections using full-strength RSA cipher suites. This issue, also
known as FREAK, only affected connections to servers which support
export-strength RSA cipher suites, and was addressed by removing
support for ephemeral RSA keys.
CVE-ID
CVE-2015-1067 : Benjamin Beurdouche, Karthikeyan Bhargavan, Antoine
Delignat-Lavaud, Alfredo Pironti, and Jean Karim Zinzindohoue of
Prosecco at Inria Paris
Apple TV
Available for: Apple TV 3rd generation and later
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: A type confusion issue existed in IOSurface's handling
of serialized objects. The issue was addressed through additional
type checking.
CVE-ID
CVE-2015-1061 : Ian Beer of Google Project Zero
Apple TV
Available for: Apple TV 3rd generation and later
Impact: An malicious application may be able to create folders in
trusted locations in the file system
Description: An issue existed in the developer disk mounting logic
which resulted in invalid disk image folders not being deleted. This
was addressed through improved error handling.
CVE-ID
CVE-2015-1062 : TaiG Jailbreak Team
Installation note:
Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> General -> Update Software".
To check the current version of software, select
"Settings -> General -> About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJU/fW0AAoJEBcWfLTuOo7tgB4QAKVJr+8kvnK/mrbpdFQOIc61
9NpRGZXQ2jTrDJonQkFJuY/IPwNGouzuD19Ozv2t+Pfd1HBC/iOp/pS43XkI7oaJ
YSQdy8dQ0oFTXWcOeIjSPvWALgplDhFn6URHDO1lHFJ1Ya9A5nsncJTH7I7MGo8I
x/SDuDiiy9XbcigcMZochNeP+tyv1Py8RkrT2ftrBKjX1VbLI2OH+nC+Qqvk3b+K
Xlnqqm6sdUwYZF9My7+MN9qkg0M2wBpItYa0+8yWIDqsBzz2mCM6IhLPfH6JUY0x
SzXtZeDc3xFU93A8qnDIvA75OlHlLztqxefnfRXt3PxZugkj/b1nATTAYEtykXvo
xdsCGYzgmQxgVnqRRijOh5Q+nUFEzrcVufwke4Z5Sp6rVfI02nM4cphYUqc/mZ2N
vBAIG1q4yv9q1GUhvyaD5ovVLdR6MTmdaTQCL/GPpMDKbsDU5Rjlm5eQwklY6438
gGpwqImimqpuQKswNppAUNQftXiGkp2/+hhW3awxgPNRhQTFO1Jdc67ChJfSuz0Y
80XAYyC3Gbdy4raUc9eZT7l1wkrGWSINfF8LdjnR9/Sx9F3XU94hFieITOe1/+em
xHiRAWa0yZ788WwDieVhaGO6IoMBTGAiFiY8vHSGGej2Ub8/pBcasuLGy+ayy86P
d4MfU3w/jKBRBd4bdrbz
=gaCp
-----END PGP SIGNATURE-----
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (security-annou...@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/security-announce/listsebby%40me.com
This email sent to listse...@me.com
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2015-03-09-4 Xcode 6.2
Xcode 6.2 is now available and addresses the following:
subversion
Available for: OS X Mavericks v10.9.4 or later
Impact: Multiple vulnerabilities in Apache Subversion
Description: Multiple vulnerabilities existed in Apache Subversion,
the most serious of which may have allowed an attacker with a
privileged position to spoof SSL servers via a crafted certificate.
These issues were addressed by updating Apache Subversion to version
1.7.19.
CVE-ID
CVE-2014-3522
CVE-2014-3528
CVE-2014-3580
CVE-2014-8108
Git
Available for: OS X Mavericks v10.9.4 or later
Impact: Synching with a malicious git repository may allow
unexpected files to be added to the .git folder
Description: The checks involved in disallowed paths did not account
for case insensitivity or unicode characters. This issue was
addressed by adding additional checks.
CVE-ID
CVE-2014-9390 : Matt Mackall of Mercurial and Augie Fackler of
Mercurial
Xcode 6.2 may be obtained from:
https://developer.apple.com/xcode/downloads/
To check that the Xcode has been updated:
* Select Xcode in the menu bar
* Select About Xcode
* The version after applying this update will be "6.2".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJU+lGxAAoJEBcWfLTuOo7tERsQAJ5wHQDlzixLxaGFWO57SoAk
oK5d6Lfs4p4E7YQ7JxVKPkVEj7l+w4tAhkBhsWpRunA7S5Ym8y44w4VL5SWU8EN6
BDm1QsLQK60Y1RPIztF2UOuUK26++pnFfLqd1R+q8b4Ir/T/gVZPWao1fkjltpcS
aoQIIhFK1HHLvQypwto68198rPvn3iLolOwWgBuVgyfUi2IRRk1A+8+omsaBD6DV
BC/l0Zu9z85NFzzAobBEBpUSTMpWBuYJB81huKTRPQrynanYThA7zX6gsRJX78zN
sbB0VP3Knh8vMlPaX+xLX20pZ+mFTpUNOirN2wwTkI1CmO+9pbXOkFxleJJ52o/n
4NxRuHMdMCC1r7HpnVauWmvcPedWV71YXo+ck3n9zLb7VUzjiIls6haFfYohgVTz
/iLzxPrA6UzP2zgD5pve6LOi8N1jO6b6b8QhAa4mxveHc9LUdirJLYsWnjuJh8I3
s7vt9hT4EJGkA3gSCNWBXoNWvYwFG9t1uuCcHD5OJCrSOKx0U8Il8y0kqj34hcBc
xYQEmokSyq1GZwGkCo81pFtYJntuxx/9KT5eodFHtzwSsOSZEkg5quHOVOfhE/sz
1rfpo1zJj+nprPEMsAkCRdB7HPHnBh1yqZGdqjzrMoztXCUa4SPFCkJEUYetmNod
mOKMaqe/h2aG+8notXKn
=F+Wn
-----END PGP SIGNATURE-----
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (security-annou...@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/security-announce/listsebby%40me.com
This email sent to listse...@me.com
--- End Message ---
--- Begin Message ---
Xcode 6.2 including iOS 8.2 SDK with WatchKit Now Available
--- End Message ---
--- Begin Message ---
Apple has updated the 13-inch MacBook Pro with Retina display and the 11-inch and 13-inch MacBook Air. “Today, the popular 13-inch MacBook Pro with Retina display, 11-inch MacBook Air and 13-inch MacBook Air all received significant upgrades,” said Philip Schiller, Apple’s senior vice president of Worldwide Marketing. “The 13-inch MacBook Pro has been updated with the latest processors, more powerful graphics, faster flash, longer battery life, and the all-new Force Touch trackpad. We’re also bringing the latest processors and graphics and faster Thunderbolt 2 to the 11-inch and 13-inch MacBook Air, as well as up to two times faster flash to the 13-inch MacBook Air.”
--- End Message ---
--- Begin Message ---
Apple and HBO today announced HBO NOW is premiering next month, making an HBO subscription available directly to Apple customers for the first time ever. iPhone, iPad, iPod touch, and Apple TV users can purchase HBO NOW directly in-app as a standalone service to watch HBO’s original programming, Hollywood hit movies, documentaries, sports, and comedy specials for $14.99 a month. “HBO NOW offers a new generation of HBO fans many of the best TV programs in the world without a cable or satellite subscription,” said Eddy Cue, Apple’s senior vice president of Internet Software and Services. “Now, with the same simplicity as buying an app, customers can subscribe to HBO NOW and instantly start viewing their favorite HBO programs as they air — this is huge.”
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2015-03-09-1 iOS 8.2
iOS 8.2 is now available and addresses the following:
CoreTelephony
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A remote attacker can cause a device to unexpectedly restart
Description: A null pointer dereference issue existed in
CoreTelephony's handling of Class 0 SMS messages. This issue was
addressed through improved message validation.
CVE-ID
CVE-2015-1063 : Roman Digerberg, Sweden
iCloud Keychain
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may be able
to execute arbitrary code
Description: Multiple buffer overflows existed in the handling of
data during iCloud Keychain recovery. These issues were addressed
through improved bounds checking.
CVE-ID
CVE-2015-1065 : Andrey Belenko of NowSecure
IOSurface
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: A type confusion issue existed in IOSurface's handling
of serialized objects. The issue was addressed through additional
type checking.
CVE-ID
CVE-2015-1061 : Ian Beer of Google Project Zero
MobileStorageMounter
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A malicious application may be able to create folders in
trusted locations in the file system
Description: An issue existed in the developer disk mounting logic
which resulted in invalid disk image folders not being deleted. This
was addressed through improved error handling.
CVE-ID
CVE-2015-1062 : TaiG Jailbreak Team
Secure Transport
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: An attacker with a privileged network position may intercept
SSL/TLS connections
Description: Secure Transport accepted short ephemeral RSA keys,
usually used only in export-strength RSA cipher suites, on
connections using full-strength RSA cipher suites. This issue, also
known as FREAK, only affected connections to servers which support
export-strength RSA cipher suites, and was addressed by removing
support for ephemeral RSA keys.
CVE-ID
CVE-2015-1067 : Benjamin Beurdouche, Karthikeyan Bhargavan, Antoine
Delignat-Lavaud, Alfredo Pironti, and Jean Karim Zinzindohoue of
Prosecco at Inria Paris
Springboard
Available for: iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
see the home screen of the device even if the device is not activated
Description: An unexpected application termination during activation
could have caused the device to show the home screen. The issue was
addressed through improved error handling during activation.
CVE-ID
CVE-2015-1064
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "8.2".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJU/fWsAAoJEBcWfLTuOo7t7VUQAIsLCBlvhkiqbJ4xdanG1RZI
Ld7787ljx6ksnLMiFJNCECOIm3fk7TKMUfFn7HXYR/hg/w0GPb7dXUNkNh9IhdjF
H8dur2Eb3iR3EPDhnGvPcgic059SKKgVUgyzMfr8td3onswWq90aG+8eAgq3ri9B
qAL8wUSoXDz0VPUJ2H7VcktfcdXqFmS5lPGa8PpEAzNAhN+utsw61yoJgILHh9g6
5axRobZFpd7CKy+ADPUtlMUYQQliRX+BNX+ZZgh1bsEmXJMmeHxKjEN6Iq18ObD7
ucFihWs6WFroDHuHMvuR/yJARqInChMzd/EMkjSfHH2ldSbTyGmsTp/4D1aofQMp
V6D8JjsHvdb/jWq5qCmFEBXf1VpXXqvNI1rq3D7qHOIJJPQH5afzI9ujymOrsspH
Li0lD2TrwnLJznoRgAGVYSo0dhouUmhRYkd4zJkQMoR/Rn/aL3xWGT5XhFEkfdFD
rvFv0LgaiC/5jbLZczUVk1yYQTkJ4mM8h02GnHd1CLvSdf1naEvTw3goBJguI233
5R89HVZA0Z2P6Vyk1bn5V0SWYasVATmjfr89lkhESVVfszakEvxTxmg4fZ65Gwtq
MWSMUBzFZT09abSUEH27BYVGYoe1HCk8sAKlOhMvd1s2O54kZbHeuIMvfrYT5C0d
3T50q8/I5HSn+5c9eHvz
=l+X4
-----END PGP SIGNATURE-----
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (security-annou...@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/security-announce/listsebby%40me.com
This email sent to listse...@me.com
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2015-03-09-3 Security Update 2015-002
Security Update 2015-002 is now available and addresses the
following:
iCloud Keychain
Available for: OS X Yosemite v10.10.2
Impact: An attacker with a privileged network position may be able
to execute arbitrary code
Description: Multiple buffer overflows existed in the handling of
data during iCloud Keychain recovery. These issues were addressed
through improved bounds checking.
CVE-ID
CVE-2015-1065 : Andrey Belenko of NowSecure
IOAcceleratorFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.2
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: An off by one issue existed in IOAcceleratorFamily.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2015-1066 : Ian Beer of Google Project Zero
IOSurface
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.2
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: A type confusion issue existed in IOSurface's handling
of serialized objects. The issue was addressed through additional
type checking.
CVE-ID
CVE-2015-1061 : Ian Beer of Google Project Zero
Kernel
Available for: OS X Yosemite v10.10.2
Impact: Maliciously crafted or compromised applications may be able
to determine addresses in the kernel
Description: The mach_port_kobject kernel interface leaked kernel
addresses and heap permutation value, which may aid in bypassing
address space layout randomization protection. This was addressed by
disabling the mach_port_kobject interface in production
configurations.
CVE-ID
CVE-2014-4496 : TaiG Jailbreak Team
Secure Transport
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.2
Impact: An attacker with a privileged network position may intercept
SSL/TLS connections
Description: Secure Transport accepted short ephemeral RSA keys,
usually used only in export-strength RSA cipher suites, on
connections using full-strength RSA cipher suites. This issue, also
known as FREAK, only affected connections to servers which support
export-strength RSA cipher suites, and was addressed by removing
support for ephemeral RSA keys.
CVE-ID
CVE-2015-1067 : Benjamin Beurdouche, Karthikeyan Bhargavan, Antoine
Delignat-Lavaud, Alfredo Pironti, and Jean Karim Zinzindohoue of
Prosecco at Inria Paris
Security Update 2015-002 may be obtained from the Mac App Store
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJU/fmlAAoJEBcWfLTuOo7tiDQP/2pmrat21oSpVVCytKMELXhx
QJ3IERRNcNOI/toYqEei7WH8XeiIBo2Eq2IRrxuNPqILEDJDzv47UfmyN9jwfgoo
R73nGHR1NwbhlvB6ckfSRqb0uLGmT3Gs+fSQSEVzlWJfrUjqwWEQwZIZubEKW4DK
F9PoKormSyciv+g0Aw0A4WvFTfAeM3qUcq3I6bIqSM76tUhzuq63TOz5e6KGoAvp
VHm34OvVU/vt0YLvi3kw5mbxisYfJPyrfTzSRdD7ATvsPc8LGWP4tG46cKy6lBVe
7T7T5lb0ApRl7JEvy37KZCMvvd+OQr2YZA8HE06FrfGw8QvoQSKaHVMxib7shq1i
but+lmTi7SUO3OY/5CqpJlSYUdaS3wTTEF6VuI3tsdHsGNNH1zync2+UmSKpIzyR
TxbGyyozbdZ+R83ULE0jar9BsDFQR9VSNiNqDB89Y3Rx6rcePFXlQ1W2J7/yhS+N
kYrlbNLeZdPFHfVKS+rl/spbEkOi+jp/W2NoBTRGwOU6eED5/YE6WN6podZZKW9b
I3NWRzFnxtpk9Y/UldV1iPlZJQzTf8smP7dUZcweCDrFQg8QLhETENG0f4r2/30u
i6DSLoFrdFE1Z1+mF3SG9++9f+PSvOXqt7iRrYJMyoPWbKtb9gxIOs8mK5T/D+vu
TJDXCjMND7F2ZJFRim/F
=7PU8
-----END PGP SIGNATURE-----
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (security-annou...@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/security-announce/listsebby%40me.com
This email sent to listse...@me.com
--- End Message ---
--- Begin Message ---
Apple today announced ResearchKit, an open-source software framework designed for medical and health research that can help doctors and scientists gather data more frequently and more accurately from participants using iPhone apps. World-class research institutions have already developed apps with ResearchKit for studies on asthma, breast cancer, cardiovascular disease, diabetes, and Parkinson’s disease. “iOS apps already help millions of customers track and improve their health. With hundreds of millions of iPhones in use around the world, we saw an opportunity for Apple to have an even greater impact by empowering people to participate in and contribute to medical research,” said Jeff Williams, Apple’s senior vice president of Operations. “ResearchKit gives the scientific community access to a diverse, global population and more ways to collect data than ever before.”
--- End Message ---
