July 2015 - Security-announce

APPLE-SA-2015-07-15-1 OS X: Web plug-ins blocked
by Apple Product Security 16 Jul '15

16 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-07-15-1 OS X: Web plug-ins blocked Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions of the Adobe Flash Player prior to 18.0.0.209 and 13.0.0.305. In addition, due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions of the Oracle Java web plug-in prior to 1.8.51.16 on OS X Lion and later. Information on blocked web plug-ins will be posted to: http://support.apple.com/en-us/HT202681 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJVpwRpAAoJEBcWfLTuOo7tlPkP/RTw/k7PjNpNY/L/y/d04S1i bJTA61QYoV77yKkYNqFoxwfWExEdKkKeijsMyZC+xrgdmhkvLlnKxrziL3jAzjIo Pma3b1lqxquNc/AEKOrLFqB5YI3iAdqvvcIP5t+1HcPZ97c5cLzJJxLjjAB/9e8b pJhh6JyeZImD5aD0tduNqWsgs8irIqtpb2RCmi1+0mU387KTWFrf231FOGGOfEEZ WSP5tJgxNPTBGtHclAXouU4bl7aJefjxF4JhOVfbZcOGKM7fIFibEjf+ieQyadKV wPzfWZLRazYlKMm1bKJOstw01+wkSPHy+fGCSYCmsodOEpku9Ni5BFTeKChWHnZd wWCDLLOU3azSGaB8hrK4fAQqX3GCvEE3YdOz3lRHEzfl7f/7Hi9oEqDc3BUe8LxZ nqp1D2yTI9PaQd/lXFMtKt+Fvc8cq6TwHzZQXMuLTKlg8ldqGfwoKaFQbe/UXyco x3747dPBaonrVcSR8HAUbdDjlTtKPLTa64e7rJReYTdreXIUAXLkZBYURD+e5W3F Dikq42OUjaV+c5AjP2vCtmiHkMbsQWxi0HNOVU8QCJbBXTjn3evZ9d3usno3+1XV Xt07MfMlp9eZyjo/vFb/ZDVrBZcp8n/elslpzU0NF5af2GEV6oZwIiEXsUbvW7w3 tcyeGJitBiYowaQg7plm =wkHX -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2015-07-10-1 OS X: Flash Player plug-in blocked
by Apple Product Security 10 Jul '15

10 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-07-10-1 OS X: Flash Player plug-in blocked Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 18.0.0.203 and 13.0.0.302. Information on blocked web plug-ins will be posted to: http://support.apple.com/en-us/HT202681 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJVoBI/AAoJEBcWfLTuOo7t8ZYP/2YTRBP7xgNUBT7JfWr+x9YI uMCXzV0FUkCq8DHOUPQjaytzmmwaSHQSL/ICcUKSbk+Y2DUzWqphaacu7umtveLx FKQxXvzjcCAUKoP3a8uO3MwCst+Zmp9FXc3aEnrU9uoL4t4WWCN+UVTHgExvXZgh 29Da+qxcirFDdy4wEIE6Q4jcLfVhsk2K9g9xDRAvGtfC8x1v1mzvQcj08/a8jhU1 oM6+qhbbSFZiEOuKxq72P8U6LG8ekeN0rR7n7AKcVmCa43umaIwFVDyLqKA/6pa0 SfWTN9xBQefTz6/ylIzFbLIUXMqZY3D7HcA1y40L5AVKqeKSNsdMw/NxXOHwBsmm vwUgbikeFnJC0U/yvBvZ69cU8JhdK+8jzJbpLbbpfirPiUd7LccgMEE3iy24GL89 TdPy8hNpclM7WW6NGe2J48GfxE+VRvQqhbqm8+he1ceJpnPs0jmV/Q+fIubpZQ3x Q/FQo7+AaxKwX/NxVBaWTXeB0nLPz9BizzKaarEj8q8mzGZrBKiTbeQZ1gWJSemd RacmVqATVw4DcLfeLEw8iuyCwk5uRG35/c9pGR/0Qvaqujz9xcRRhdEoAThnUei5 EjGI9G2lZ2zRS0H7Iat/BC8wbhqkrfEYMXMVvqQUqJxHnHAKoUfENdh+lA+wKE2b VURElXMLdCy/BK8dJraH =En8+ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2015-06-30-6 iTunes 12.2
by Apple Product Security 01 Jul '15

01 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-06-30-6 iTunes 12.2 iTunes 12.2 is now available and addresses the following: WebKit Available for: Windows 8 and Windows 7 Impact: A man-in-the-middle attack while browsing the iTunes Store via iTunes may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2014-3192 : cloudfuzzer CVE-2014-4452 CVE-2014-4459 CVE-2014-4466 : Apple CVE-2014-4468 : Apple CVE-2014-4469 : Apple CVE-2014-4470 : Apple CVE-2014-4471 : Apple CVE-2014-4472 : Apple CVE-2014-4473 : Apple CVE-2014-4474 : Apple CVE-2014-4475 : Apple CVE-2014-4476 : Apple CVE-2014-4477 : lokihardt@ASRT working with HP's Zero Day Initiative CVE-2014-4479 : Apple CVE-2015-1068 : Apple CVE-2015-1069 : Apple CVE-2015-1070 : Apple CVE-2015-1071 : Apple CVE-2015-1072 CVE-2015-1073 : Apple CVE-2015-1074 : Apple CVE-2015-1075 : Google Chrome Security team CVE-2015-1076 CVE-2015-1077 : Apple CVE-2015-1078 : Apple CVE-2015-1079 : Apple CVE-2015-1080 : Apple CVE-2015-1081 : Apple CVE-2015-1082 : Apple CVE-2015-1083 : Apple CVE-2015-1119 : Renata Hodovan of University of Szeged / Samsung Electronics CVE-2015-1120 : Apple CVE-2015-1121 : Apple CVE-2015-1122 : Apple CVE-2015-1124 : Apple CVE-2015-1152 CVE-2015-1153 CVE-2015-1154 iTunes 12.2 may be obtained from: http://www.apple.com/itunes/download/ Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJVkxn8AAoJEBcWfLTuOo7tYPoP/3l/dw+rYzo6GHoE0xZM/4nc 0kq2Wx+f8blymEOs6cHM7hvR4YTRc+O/QnNZXrVVxa7SqFG2dnE203sxOFyTfl6t yzN2ueA9IGC0W6c3YBo3ej1Fifi9ey25P66AParFU+7jI3Pj3mkKb1ClrFb6gCzc U743HOcnmmqSpnnXfxZPt+y2oDasweNt0guCpYYG8mcG2hzyQfSmA8EEh/Dzplv9 Nl2NGAqyG3Cj8ZDOoPIZcHYZ8h2DHl+YyczVyryo6YwadRPq54pDKDOjsDmVUkl9 YFZu99gdDK/QVudRolmj9ZjvdAi5fpJJZ0hHl7giNzo5wKCVIaTVgzjVRjXWWvRZ JwTt07sky25py+rQne62/heKfIhPwv2pNyZmSLSpQsb8+yYVKw0mX5nLmko91+yS kPOMRF5f/Ek2aYoRJ9DruVpMFs1kHIC3ynh5WQrAWkono1fU/U1Wxz2yGPuU+Jhm dghvFEjH8uHaayaeNilTKqAfxGBOpd9jKzUe3bQ8gbGNtruun0QxIUsa9DE98giu e1OtNo70kt1EznEPeAoLwhVb/jQE29OlZyhN912tvTGVjExCmIxcZQdw537yWj7C ae2Kjb4l8ni4T4ta0i1mxC/bbsHa8u/gs8DcMGGcjnbWUAJx6oOAAzY6x9SIfZqa szGbF5r4TZ5KFgMW9I6o =Vyyo -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0