April 2013 - Security-announce

APPLE-SA-2013-04-18-1 OS X: Java Web plug-in blocked
by Apple Product Security 18 Apr '13

18 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-04-18-1 OS X: Java Web plug-in blocked Due to multiple security issues in: Java 6 update 43 and earlier Java 7 update 17 and earlier Apple has updated the web plug-in blocking mechanism to disable versions of Java older than Java 6 update 45 and Java 7 update 21. More information on Apple-provided updates is available at http://support.apple.com/kb/HT5734 Information on blocked web plug-ins will be posted to: http://support.apple.com/kb/HT5660 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJRcDUrAAoJEPefwLHPlZEw5yIP/igwBOjn/zHLPq875kayFcG4 6eeOKN1CROmODai1nfXlGsW5SAyRyqpN9iG+Cl36hO1ypmd6oRrmxecF+WgjQdRp bFjK4FdNFkJku0xCJMf2QIP8bu1fVcz6mhCVmXtnvY+sN+Km6zSRxBoFfS37dHzm CCAmCH7wYIngfm8dMMGtLJjgt4IThebTDd9jMYQNNS9kWblrNKGWlO/mqB8UtPWY gfDZLWIV/bSEdL3D3iU5nlz6yxHGNNOYTFwcKx09aIs73IaWKsiRkb35x9RP7NNB TJdn0J3R0GLo96QAvO8EkxgFQYGEmiOJYYmJ4sHJjZdRuoQhKiJHZwrs4mdxfW+I Viw9zt+yiF54y3hXby8vNjc9gmif9ItVgIqQW3ooNBAO+Zus2mYKUJcT6FEmquyF 8b1n3xWW6ck5WWq3As14xkpk0RvFX+oA80wjpwMCN2mJgR/HRCKgbQ13yIZ2GT0J qtATu+WMP93JWLk4uQ9Fz/8zC/kM7kYl6EH9aih3h5EuOXn1GsRyNgDBOHlKV+qc WxbWHQNrhd/ImMKUnvXgb1DdqXjR7Y/pyOototUqAFDq+35IFTERFLY5sNqJrRsB oZ3tQXZ7AvQhknIhgzaycCUoHCg25I4xi98sA9NJrztrA5TtgfZ8JieKN/tSTaM9 3MwrVXxZokfrVuy9FCRw =Cywn -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2013-04-16-2 Java for OS X 2013-003 and Mac OS X v10.6 Update 15
by Apple Product Security 16 Apr '13

16 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-04-16-2 Java for OS X 2013-003 and Mac OS X v10.6 Update 15 Java for OS X 2013-003 and Mac OS X v10.6 Update 15 are now available and address the following: Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 or later, OS X Lion Server v10.7 or later, OS X Mountain Lion 10.8 or later Impact: Multiple vulnerabilities in Java 1.6.0_43 Description: Multiple vulnerabilities existed in Java 1.6.0_43, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues were addressed by updating to Java version 1.6.0_45. Further information is available via the Java website at http://www.o racle.com/technetwork/java/javase/releasenotes-136954.html CVE-ID CVE-2013-1491 CVE-2013-1537 CVE-2013-1540 CVE-2013-1557 CVE-2013-1558 CVE-2013-1563 CVE-2013-1569 CVE-2013-2383 CVE-2013-2384 CVE-2013-2394 CVE-2013-2417 CVE-2013-2419 CVE-2013-2420 CVE-2013-2422 CVE-2013-2424 CVE-2013-2429 CVE-2013-2430 CVE-2013-2432 CVE-2013-2435 CVE-2013-2437 CVE-2013-2440 Java for OS X 2013-003 and Mac OS X v10.6 Update 15 may be obtained from the Software Update pane in System Preferences, Mac App Store, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.6 systems The download file is named: JavaForMacOSX10.6.Update15.dmg Its SHA-1 digest is: 56a950f7a89f2a1c39de01b2b1998986f132be57 For OS X Lion and Mountain Lion systems The download file is named: JavaForOSX2013-003.dmg Its SHA-1 digest is: 3393ff8642b6e29cacaf10fbb04f76e657cc313a Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJRbatSAAoJEPefwLHPlZEwsl4P/ixeRjTgN3MFTNK4VTobV93j zbj99S53RY0R7vOd7lZe6QMnLjvAEC+wF5BEsWcLbI/+L1ewufE62TeC3K0v7QH6 GExzGa41GCfICF3cUSQNopXy3KvskLACpOmK3LKxUUtP2NL7+As3HpXyaU3pPvxk EQE/Af9p4IzPECvZzBe8KfJuQWeUWYiQhN+nH6ei4E2FS6vXaUlTpOn6sUVyeDfR JX3NFmbXuJB0RKQcKicGSx8x1lZTRFSVPbb6HPfcvHHnfUe2WqqA6SwUZavrtY6C jiSqAB5Vog8oTP4XZhgrxPlqohZqnYJ7Fnimrk+LeiPrJ2Is3W6TM9kEhU6vfgCm xIDC0GuZRToiWDzUQskeNitUDLGYz+32a/4ZyFLGtHZdiGhOgiuqGuYPnCdRvhGt 9kMgcOC5f/C1uBNAw8pCDfsqm00dmA6IV1QRHZLGKQhUsiu3PbhftB0EiUiEwlcX la5Xvp+3AkupO8Gc0JOnAvVgYy7s6IupHUzwsMD3vDEzaF1lrQ6+z6tjhibhc+mb y0VycheIUSUyNuLt6js06wyhK8VW5vkNFG+Ogj1xm/3Y2sSJQfxGsOMqRwrkBN7p EEKV7Nck9G/qsuKBzEZJ3CFDkF6RJezoYN8v3QG+sZLEt4WFVkmtG86NgEVPu6gp tyT4/+vnaqKDRbcwCKXy =bvDt -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2013-04-16-1 Safari 6.0.4
by Apple Product Security 16 Apr '13

16 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-04-16-1 Safari 6.0.4 Safari 6.0.4 is now available and addresses the following: WebKit Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8.3 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: An invalid cast issue existed in the handling of SVG files. This issue was addressed through improved type checking. CVE-ID CVE-2013-0912 : Nils and Jon from MWR Labs working with HP TippingPoint's Zero Day Initiative For OS X Lion systems Safari 6.0.3 is available via the Apple Software Update application. For OS X Mountain Lion systems Safari 6.0.3 is included with OS X v10.8.3. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJRbOeOAAoJEPefwLHPlZEwksAP/Ri4p48A5xqlZjpsEjoHc6Zf rIm01xAyqsVUg85leD5NP+8yqvEFV52FEG1sONslOFbnRz62RPWZsOtPs0sIrfYR svRiCdXrB9nHW6NkrtXuEAAzFZl1VQ5Wu5ojWJU5VNrcW+Idml0eV9ktp5V5mSH1 dy+airv3xYGJt+35JttKTgKEPFLcU5uSxssEQb4SlTBDdCZFBV/+nbcDh0t1sapB aS9iZnzbEh/mapMzkxMy7PBV3GGgu/bkTziSk5jV6G9WNaRUzKHrJgbIYkV1wDn0 lom7tyozkU+1P/XRYOJsdk+8Z8b9Zy6eihsvMgnWh7vBqSRHO1v6MTkIgkNQe64i MQsmPbo3AuPq0EgKrUWHwO86OSy1J9lKiqsPCrGul05VhRAsTLTn1RiKAN20PsQH XQKog9Nfk1yNrL+ONSlYB13w56QKDzzXmwWFRHBrwfMxH/YDICDPkLJumsOSS0SL nuz9hfNCD7tKUg2/3JV2RVf94xa66Zli3j524VG54s19aBrUqx1cbqDBvAl9lyJY hCijZUklOGYI0RPbP86dv1NdUdBN5dOT2foqlrGQU83ppvTO1sNC8NNFe+81RhkV QXweNwnYMcW7183xz2Xenh4+oihzpg2dcn2FNlmu+utMMX7P+6ed9nYLbpR1FlEp z4SkKyISyJ+dYYK/o0J5 =Vj0q -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0