February 2013 - Security-announce

APPLE-SA-2013-02-19-1 Java for OS X 2013-001 and Mac OS X v10.6 Update 13
by Apple Product Security 19 Feb '13

19 Feb '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-02-19-1 Java for OS X 2013-001 and Mac OS X v10.6 Update 13 Java for OS X 2013-001 and Mac OS X v10.6 Update 13 is now available and addresses the following: Java Available for: OS X Lion v10.7 or later, OS X Lion Server v10.7 or later, OS X Mountain Lion 10.8 or later Impact: Multiple vulnerabilities in Java 1.6.0_37 Description: Multiple vulnerabilities existed in Java 1.6.0_37, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues were addressed by updating to Java version 1.6.0_41. For Mac OS X v10.6 systems, these issues were addressed in Java for Mac OS X v10.6 Update 13. Further information is available via the Java website at http://www.oracle.com/technetwork/java/javase/ releasenotes-136954.html CVE-ID CVE-2012-3213 CVE-2012-3342 CVE-2013-0351 CVE-2013-0409 CVE-2013-0419 CVE-2013-0423 CVE-2013-0424 CVE-2013-0425 CVE-2013-0426 CVE-2013-0427 CVE-2013-0428 CVE-2013-0429 CVE-2013-0432 CVE-2013-0433 CVE-2013-0434 CVE-2013-0435 CVE-2013-0438 CVE-2013-0440 CVE-2013-0441 CVE-2013-0442 CVE-2013-0443 CVE-2013-0445 CVE-2013-0446 CVE-2013-0450 CVE-2013-1473 CVE-2013-1475 CVE-2013-1476 CVE-2013-1478 CVE-2013-1480 CVE-2013-1481 Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 or later, OS X Lion Server v10.7 or later, OS X Mountain Lion 10.8 or later Impact: Multiple vulnerabilities in Java Description: Multiple vulnerabilities existed in Java, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues were addressed by updating to Java version 1.6.0_41. Further information is available via the Java website at http://www.o racle.com/technetwork/java/javase/releasenotes-136954.html CVE-ID CVE-2013-1486 CVE-2013-1487 CVE-2013-1488 Malware removal Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 or later, OS X Lion Server v10.7 or later, OS X Mountain Lion 10.8 or later Description: This update runs a malware removal tool that will remove the most common variants of malware. If malware is found, it presents a dialog notifying the user that malware was removed. There is no indication to the user if malware is not found. This update is available for systems that installed Java 6. Java for OS X 2013-001 and Java for Mac OS X 10.6 Update 13 may be obtained from the Software Update pane in System Preferences, Mac App Store, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.6 systems The download file is named: JavaForMacOSX10.6.Update13.dmg Its SHA-1 digest is: 5327984bc0b300c237fe69cecf69513624f56b0e For OS X Lion and Mountain Lion systems The download file is named: JavaForOSX2013-001.dmg Its SHA-1 digest is: 145d74354241cf2f567d2768bbd0a7185e7d308a Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJRI/A/AAoJEPefwLHPlZEwDp4QAKz9nfo397KaudpFDey26bsb GNR8HQ3Z5Ln0ArgwBcc2XabzIYXsjmY7nPdZgq1m0sWgFGWtfQ7qslRooUyNLOsB WUddu+hQYvPn3CJOZsaPfTA2mfK6Qk9LeyqzUUkZrRNltHnIFMO7uXLEIdrFdnnx exFMPjbIq+xM5UZgvd/2grtF4DaZHnbcK+t/tDwH09/hGRQ+l+3a/3FB2S1Av85c FSuiieyrz2NNnDwFCj5NeSFQuK7hr52TiSOEPYI2eiTepyBHrUy03wAe8uwIzQII RjkY3Nbc8AZt0Q6lq5TgsQbH+vrwVE07nty36uMKmE2vJXyOAIZjfrrwv9SetLwd QnU5NYMbeHAHmSN5JQfuvDxEfL15/7Jafw2noJGotdrMzs6XQACFIHKqLORdwNkp sltj3LwykpcyoCR8Dq7NPafqhp2wySaHX8DFSohcq1aa1w+SLDgPCZUAzknwokCL f/hVQzP6hD0uHP/2jsLjh5g6TgHmCRdR+CKCs7QZaYAUketelRX9YOcgcXzqf5sy EcbDvJ+rd3KsQ9gIByGwVhHD87NSZDJAyG0ROjMMS9w/7l7nhGxedzGzlyK3oNl/ VpewgZ8FpUrvY80HOPz5XyFmX+HQoSnJ8er6OI5AvHBPn+Z1yHDLS5zpLeDD/wO9 rmbzMJjZUnlCDXoLEVQ9 =qlVo -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2013-02-04-1 OS X Server v2.2.1
by Apple Product Security 04 Feb '13

04 Feb '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-02-04-1 OS X Server v2.2.1 OS X Server v2.2.1 is now available and addresses the following: Profile Manager Available for: OS X Mountain Lion v10.8 or later Impact: A remote attacker may be able to cause arbitrary code execution Description: A type casting issue existed in Ruby on Rails' handling of XML parameters. This issue was addressed by disabling XML parameters in the Rails implementation used by Profile Manager. CVE-ID CVE-2013-0156 Wiki Server Available for: OS X Mountain Lion v10.8 or later Impact: A remote attacker may be able to cause arbitrary code execution Description: A type casting issue existed in Ruby on Rails' handling of XML parameters. This issue was addressed by disabling XML parameters in the Rails implementation used by Wiki Server. CVE-ID CVE-2013-0156 Wiki Server Available for: OS X Mountain Lion v10.8 or later Impact: A remote attacker may be able to cause arbitrary code execution Description: A type casting issue existed in Ruby on Rails' handling of JSON data. This issue was addressed by switching to using the JSONGem backend for JSON parsing. CVE-ID CVE-2013-0333 OS X Server v2.2.1 may be obtained from Mac App Store. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJRDIF0AAoJEPefwLHPlZEwu+0QALAQjISSEnNzyaYURMyyBjDX B7xa8fR+no5kVcXWa6rOiVajTgMra2PN1SWolM45NMealeDmAooumuktXt/tEgp4 umobB5BHUt8PS8H0f19xoPNKMKsk4140yHsIlkyExKXfu5a4D35umPSPc8vuUZx+ nieClNL44GC4+8b14Tgkbhkg0MJwhTjcggU6pjlT6niqUqQH2jrPXdcr4MZ/ONtQ vvikiZA6rOPWNYs24b4HvOYMY/GSGorOaKshrQNivCh3awG70zXfQJCc7Igcxw82 mv34FRXgq6p3pAnigewQBkCGDeVn51COpd4umDzaUjkwZ9uyFuOtAzdJZ9hzVHd/ +q10PIjdH10P8nDj6Ykky/7LxjeAdFiX6GANR04qNVPzhVjVvLjEO/CKjXUQHpsm lf8z0/U3CieIKFLyOVbBpyWabVfo3N678suhoaxvZeBANNJgNzJg27uomVvW9gNl EzrZg081xBVl2ydYYRcewRBKW/Ectxz+U3OsTcedjuXIfIMihpXDm8SEilgSow3l w6TXsfaCriWmr+KQVXCQvUICyUUQcqxF7Tcos9It9RmjymtlUskw+T2hkmENIi2d 2Qg2I92gpVuOAnU0JZCWL8+oMXQGzm+qY5CWAx2iYKILUoGjUXweUI7khR6Mparr EoPnPQxbWOTl/z8O9WFf =0rrj -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2013-02-01-1 Java for Mac OS X v10.6 Update 12
by Apple Product Security 02 Feb '13

02 Feb '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-02-01-1 Java for Mac OS X v10.6 Update 12 Java for Mac OS X v10.6 Update 12 is now available and addresses the following: Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: Multiple vulnerabilities in Java 1.6.0_37 Description: Multiple vulnerabilities exist in Java 1.6.0_37, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_39. Further information is available via the Java website at http://www.o racle.com/technetwork/java/javase/releasenotes-136954.html CVE-ID CVE-2012-3213 CVE-2012-3342 CVE-2013-0351 CVE-2013-0409 CVE-2013-0419 CVE-2013-0423 CVE-2013-0424 CVE-2013-0425 CVE-2013-0426 CVE-2013-0427 CVE-2013-0428 CVE-2013-0429 CVE-2013-0432 CVE-2013-0433 CVE-2013-0434 CVE-2013-0435 CVE-2013-0438 CVE-2013-0440 CVE-2013-0441 CVE-2013-0442 CVE-2013-0443 CVE-2013-0445 CVE-2013-0446 CVE-2013-0450 CVE-2013-1473 CVE-2013-1475 CVE-2013-1476 CVE-2013-1478 CVE-2013-1480 CVE-2013-1481 Java for Mac OS X 10.6 Update 12 may be obtained from the Software Update pane in System Preferences or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The download file is named: JavaForMacOSX10.6.dmg Its SHA-1 digest is: 0c790491ca22ee009086ee1ec1f1b358024dd83e Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJRDHzrAAoJEPefwLHPlZEwARUQAJqht+yZpLhvksCJ+hFcvdGI 6K+xYeHlIwjYmF+/QekNxOpkCvdjfaC5YVFKIretUePA7t+E/kkj2UbBrLOpOKfk Sh2OFOTTwFdQf7naDgdIROos5c8iNFUufGzjJFUzjUeEiVDFI37Keij+pttYsPXs 1n9T2YajHAsSsbjb6ldIOhV03WkjIGKH3k9Kn9HiwFA4s0lIB01TiKKEgpUfBVVM HwoHtXrgt5lFbR3w80iyhGKnB/Su2JkQ6yIgK/66OkcvTziyZlxi7HT39MjH7gLK uuKoKfD2jue5P6Sk0YKQ8LA+5qD+ODmYEQwSov1Kf13ARVSBrLnPnw+Chx1rjura QyVAP6q+Ss8Im0wFpXH9HlHWy1FiepABgvhM0GfxB34Qwx3mrG3w5cy4ASQDtveb vXOkko4XKZ1rrTq3GpIX+zl1KVdVQNXjzhN9vx48mqK9IXogAwBQcFJX/P1Bk/2k 38nkjmCD3peSBq1PGwoSO/3nKDXS4mWc2caUSgT//xVrl9hFiss7iuOHT13lnuu9 yXKjNjwH4Mi1LIVEghgr0CLnUiYiHCiGKlBIRWGqHkUGQONtmvQh6aoFg2Er5WrM lFikl3hM5JMm9vpW6pAJRvdfKghniKaO6ekJzlSj6smamBwLBAo+lcDg+Z+FxMOX FeQoXC/8drXJLOuVs4wQ =qzRL -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0