December 2014 - Security-announce

APPLE-SA-2014-12-22-1 OS X NTP Security Update
by Apple Product Security 22 Dec '14

22 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-12-22-1 OS X NTP Security Update OS X NTP Security Update is now available and addresses the following: ntpd Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10.1 Impact: A remote attacker may be able to execute arbitrary code Description: Several issues existed in ntpd that would have allowed an attacker to trigger buffer overflows. These issues were addressed through improved error checking. To verify the ntpd version, type the following command in Terminal: what /usr/sbin/ntpd. This update includes the following versions: Mountain Lion: ntp-77.1.1 Mavericks: ntp-88.1.1 Yosemite: ntp-92.5.1 CVE-ID CVE-2014-9295 : Stephen Roettger of the Google Security Team Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUmGKXAAoJEBcWfLTuOo7tJHwP/iHNiJAZaFxvN81LT382jy3r qDX4YjdhMydBCf+EW/WZJW1mfpqeFS29+4a4HAzxgSHNp7nrhHcyGc1sRkcIj2Co jwISJ3if1+8puTeLjHDaWEozYwGVVXdLQrkqYkbDEzWAimN9jSfOjjKLeVswyVdw o7ZrMZ9R3SqGcrw3tkqFPduur03Ip4a220g0kjydNdkAATHv6/U/eDI7pBybhWWy xQfY7gZxwkP7R+vo7xXgC+0U2j74TIZOS2OYZwS9/7YuKoCq6CETXEVSsXRg/9aN mRwVBneBKVLHKKaXhwbpKT/SQdNvCmmqbI5qG8J5AvNtXyo2a1Y8mXlA6Mp91PTf zZcwCZZyXbNJ3oJK8DEnwP9MjkzZzoa3K5EZQr/4oSTfsG3EJilPPD05GukrWggJ EUdBJZ7+QFwjIEwqXYW++fPv97WW0DZxQvkdkImtFoGdfR+cOXWyhtqk2aaz6JFO vf6C2dTVILHz8rHVfzMxBApgRnZjFe6c04fbW5YSfIC4Qjc4XSm9/KkQYf1YIGH2 s6TOkc8qrmUTgh+VxDoKPU5K/O+1IfTByiGBii+G4cPB6wiXZj43x7zjC+6bgnCo R2UhO62hnEA4Z1++KuYVINfiCKMkxnKHVvGOdb+pBKddGmCeUiM1H0LO/l1/kaFR kNQ7cG1OCTFtFJUpClub =xyD0 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2014-12-18-1 Xcode 6.2 beta 3
by Apple Product Security 18 Dec '14

18 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-12-18-1 Xcode 6.2 beta 3 Xcode 6.2 beta 3 is now available and addresses the following: Git Available for: OS X Mavericks v10.9.4 or later Impact: Synching with a malicious git repository may allow unexpected files to be added to the .git folder Description: The checks involved in disallowed paths did not account for case insensitivity or unicode characters. This issue was addressed by adding additional checks. CVE-ID CVE-2014-9390 : Matt Mackall of Mercurial and Augie Fackler of Mercurial Xcode 6.2 beta 3 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "6.2 (6C101)". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUk1PKAAoJEBcWfLTuOo7t268P/2z353ePUi8rj8332xbzgYsz Jc4kMXnGe1jM2Gx12RuT/v/QIIjfguCSzExXimQriFTIbnkFz8rYDPqSFI0fM2T9 8dbtpED3VnsvGQmAUVCfd9GvtqDvx6ZPW2AKih6ly7XtGtqBZLxssGbZFvXNU4X3 fDbmF0jm8nLQoAcpFvarERmhQQOeMDw2Grf3ynPpMxe2iznAkAR8Asves8sUFh36 ALdDyQtW2WhWSUhHN8o31VTD2DgV57VwJ2rL6F9UMHmOu7x5SBAATLaNRD1fQOrR aMmFypeUQR1/6CyTT8E9ReUy5iG4X+Sy52LPB7sovPTLIweaOW1Ru12XEbjhBzR6 ZNUMcujQEAWwzaHPBIzDKCcG74QY/JpZzrnwvgvgVZ+nrM2tDtSUbfHmGJGzLDNw xmE+fn1Ik1p1pSShOUO1/2uU9fM9x/P86Kyp07QG7sOZoJN6Wbn+CM/TGwpLBRRs 4Rj+NxlNph5IWzfLIJqCTu4v8hpM/jIMYjQG69BewXOisZVKw1FVHWIzbxHVIApH n+Kk4Wc2qhLaLLiPzMaDrwe4i5in8ImDhTUW0WH6Un7xuojvRFvTWLchc/Z7QJ6l +ExN2msjPf73iHY4c9E4eWNOeIyzrpyyHqrxswnlp844fpDHF9Qc8jVScywMtcc0 qOvKkbiVCkNdEtNdAq0d =Umq9 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2014-12-12-1 OS X: Flash Player plug-in blocked
by Apple Product Security 12 Dec '14

12 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-12-12-1 OS X: Flash Player plug-in blocked Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 16.0.0.235 and 13.0.0.259. Information on blocked web plug-ins will be posted to: http://support.apple.com/en-us/HT202681 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) iQIcBAEBAgAGBQJUiywuAAoJEBcWfLTuOo7t+JAP/2iCgGC8mefRlj4+vv4UDcJa XQfj1+ja5rTzzbqiWbgahgQSI4Y0ZQNfFbKwvWTddjWPO3rl9qyVNqnnWt1+BRmt lg6DT/NCNmeBtnE6YvtBAo5lIVjF8xjLxhUovYHz40sWYufPNaUYEEkuLKbWve5c ws28dDskBSZus3p3F2gqRMsI5L5LChyINjSnEaSdwwX8WHbtQMQic+jX24c7YPnR wO37JCj4z3x0dk+d02qGuLCom0r3Z1xqMWHTvudXS1ZRl+hfpEb+w6l6fSL19EBW tS59sdJf0XlhPAoKH5dxLLNdjZm5jffsPFVBaawh5hmxwHD3Ll9w8RsbETqkDfLz MrntGgBQq4wkgGj2kFqdRD+U6hrOCfN+sH3Moxbe2emArK5VRWiq+FgRfgbCqC0q 8DahsizEkPEFp5hruKWFQ63+a9w/D3ZWHeIlTvtguSkrRNXLBR/836pPRKTawfTD FPprIFPMZczkwdNi0POaABvu1K+SNmv0ZBQUb/Bty3oRKZHlXmioRymB0J/hvjXc c2+2PLvy3lEhTf8wYehq3jEAWGbsxSIJO6tb67fbVGjYotf6IPJquU29YjR0uwdQ xTwV00IoyHVBnKRNVNwhrYfBJp5Sbnh0zn31KbehtPhcC50FV9TBYnfjjgrekPg8 8b6QFQmPbBNsY6g+a+Nb =772/ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2014-12-11-1 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2
by Apple Product Security 11 Dec '14

11 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2014-12-11-1 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2 are now available and include the security content of Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1: https://support.apple.com/en-us/HT6596 Safari 8.0.2, Safari 7.1.2, and Safari 6.2.2 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - https://gpgtools.org iQIbBAEBCgAGBQJUiMEoAAoJEBcWfLTuOo7tGjcP9Rts+UOqFZo/ZOo5j8tXy2PG V9wsmwezlLeBsY7ttAoiyf7/u3C2K2eibUBj2cVrZscpPe2QgVIc/bbvSicSf+9N 3hY7LyRwOHONvH33DnO6lRHiC/sjDjaPiJsSZqe7sI/bt85z7xmhQgjPOg60qcvv 0Tmqo4DWYjri1e4Jhny3NWzDad8rGFVbPLo3k3EljZmMtDj6MXnXQfZjvQdIYlGh PRkMGs+H7NgbceeM07ev5e4vq+HW79qkQ6G6QJiTxeT1A5zSALgpXaijoxYyH+dc /FGne/EuKGJfDjbXUgMkqZNHwb5WKVuovC9OFpgVMZgbTNgOHfg33Z2A5/H0JtUZ kCgPxmdoFtOF5/H117bz6/5i6QJnXOlGPiDW5ydka7U8frICZalovFv0DmHwelPC W2bHq7u7PbH7Ho/y/jvADouAfkLkRUPKA3wcqWghXCNbiGy05tjFEqnHyhTdTLmI f0Is3vqp8xtccExBKqCXPWtVcPvOpVoDN8OKtrFt2m+IvfwokPsHKIR19ocmViMb ikVbpuabQMH2r5MT5jM5CUv5Z0KmKQM7Kj27uISAeiFFwyJiwRVbgpWxgt/hNCFh F5kDTB5az9ihqbE71L88/4/iwQVjHjC74f04/zccu31gYINAKv3T4seEsyuneHIT a+SfNZcPypUojGCslhM= =CJla -----END PGP SIGNATURE—— _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2014-12-9-1 iOS 8.1.2
by Apple Product Security 10 Dec '14

10 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-12-9-1 iOS 8.1.2 iOS 8.1.2 is now available and includes the security content of iOS 8.1.1: https://support.apple.com/en-us/HT6590 Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "8.1.2". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUh5NeAAoJEBcWfLTuOo7tU1wP/2nkHWHE6tMk3MliuGTWPgOQ bBTUTn71tc46iniZYosRTSKVY8b23jED57OhubCy4jS9Nw3gXOpguGMhNp9+9yWh 3F5fDnkmEjUwX8DTEya/XH+E+89CGUB7ysqDgy2pdkAsHPS8NHDeapRgXWFEK/F6 l5xvWGYTpqKE9JlEZisBKOox9Bm5C2i0/0oNtPIIB9mqPbFgrX4bZe5dP53RBABE 8JVPSI0uRRqNJHc0Q4wg2Re5e4MmT6n9apcHDr9A7d7XL4d9nf1erEdSiItk5ov5 reI4yRxJ6j/yE3FZQL7dikcKjEOXcKlujWkTfZUT3W0sBVcz4bua6pbQbfjgQJTv z0d7/gg9ftOOqdjjJ7chKzr6NRsc1VDUpY56nQwNSG88sssAsSKi3iOngAxpDCEi nzbk2MDaQ0XrCjF1ViZe0mCysqhcQ26MgYb2eIb2HWzHu4fajNZjaIJnz5OUtpD3 gafTgwmsVYAEuzdpWsyAHuP8GzbN76ckYowZUzc265wY3WMKJ2qEtJxDqJDX3c7Y gERP8NpDomVImrAJzLaBc+EDudWuZ7pVWNtoALgPoudyJJQkUAaFnapA1tr2BBFF Q83czo7WK91L0SWPlrCLPWoSMqGrENsR9NC39YaPPMJr/LTV3IuH+51erbFT/7tR 6zaepHK412hfvYrFbSXD =aVu1 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2014-12-2-1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1
by Apple Product Security 03 Dec '14

03 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2014-12-3-1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1 is now available and addresses the following: WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10.1 Impact: Style sheets are loaded cross-origin which may allow for data exfiltration Description: An SVG loaded in an img element could load a CSS file cross-origin. This issue was addressed through enhanced blocking of external CSS references in SVGs. CVE-ID CVE-2014-4465 : Rennie deGraaf of iSEC Partners WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10.1 Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: A UI spoofing issue existed in the handling of scrollbar boundaries. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1748 : Jordan Milne WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10.1 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2014-4452 CVE-2014-4459 CVE-2014-4466 : Apple CVE-2014-4468 : Apple CVE-2014-4469 : Apple CVE-2014-4470 : Apple CVE-2014-4471 : Apple CVE-2014-4472 : Apple CVE-2014-4473 : Apple CVE-2014-4474 : Apple CVE-2014-4475 : Apple Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUfjjSAAoJEBcWfLTuOo7t1PsP/j0H8iRJiPtYVwRly6mxyDrv 4Ji7sopCSNa96qcqn9jILbFTkthqaXE/vew2UdJgO5CSXqxcF50I9bUkPJyJBq4j qGEu8a54pMteNSCtox1mwzZu8tcOArc//oQhMPhqSRkEvjVv2bsJdQ9bmc1QqHhP HkJBN/HO8w5RvZ6o5PiitnOOwVOu2sEX80mI7eYKmRjl7AWMzVE6sER1boL+EyCW 4F5s9610J7KjpWh2QewhhefYPootah9JCKoybTrrba+hBESYtHuRwTTkay7cgMkd J+a4xdjngl/ySFqOH7IhnnUD8Cs5UelHk7HlwqoGTxsaRjKnWlZ+1PqtE5buN7v+ SeZeYqeWwSJEeDis55dMIHuKmYl3XsAHU7405A8AW27YLh+ABrnZNctebHub3bJ8 BayfF1h1AHh1UohXnz7u6o9LKavmKzy1VoUiTBKbon+4mBILuj9MlJVXxCIq/8Sl kmxKlE969d1Ij/6LeNKb/BZ9SYoEOdkgZdqO5BNNtsBgE17xm5yGuJeZyour5hSM 8a9FwRf9QjKD/xodIP0VtB/c53eUe1DRJNgwXkmC4K+7nslBexmzDOxs2bG2LXOU z0aExXx0goTI5K14PRFE+hLVDOw0jNjp7K2EQAKSK9oKF1sR/tk2nqO/AduSArbe bftlUMkfPwAuqhtNajQZ =S2wI -----END PGP SIGNATURE—— _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0