Security-announce

Download

security-announce@lists.apple.com

May 2018

1 participants
2 discussions

APPLE-SA-2018-05-08-1 Additional information for APPLE-SA-2018-04-24-2 Security Update 2018-001
by Apple Product Security 08 May '18

08 May '18

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-05-08-1 Additional information for APPLE-SA-2018-04-24-2 Security Update 2018-001 Security Update 2018-001 addresses the following: Crash Reporter Available for: macOS High Sierra 10.13.4 Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved error handling. CVE-2018-4206: Ian Beer of Google Project Zero Kernel Available for: macOS High Sierra 10.13.4 Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: In some circumstances, some operating systems may not expect or properly handle an Intel architecture debug exception after certain instructions. The issue appears to be from an undocumented side effect of the instructions. An attacker might utilize this exception handling to gain access to Ring 0 and access sensitive memory or control operating system processes. CVE-2018-8897: Andy Lutomirski, Nick Peterson (linkedin.com/in/everdox) of Everdox Tech LLC Entry added May 8, 2018 LinkPresentation Available for: macOS High Sierra 10.13.4 Impact: Processing a maliciously crafted text message may lead to UI spoofing Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. CVE-2018-4187: Zhiyang Zeng (@Wester) of Tencent Security Platform Department, Roman Mueller (@faker_) Installation note: Security Update 2018-001 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlrxvQQpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEY/HxAA tRDFZcMPnxucIk9vENarx+oXzhMPGDJri16zOS9m7gv019GP10OJ2aDyr6GQpaK1 s0eCGXMqXuZ3mr7ZDikleB0xddPi+9mEjqSkfgxeP7WKFXSjAFCjc6sbv1SSq8IH km4yqtbQLFiVmL4BYnVW0GhYwWAgFn3QAKKZjD6TZYTrtOnxuQKkPqhZgD3xLG8y aYd0FgRX2AN23c157Gvn/nN3gYAtLxhlCwv5DcMuDH9BNPB6RR+qNPWaz6nxOukm aOeigkHhYwvVK4AlITE06R4UBJRq8LBxC2xLzEbr4jQZnRq1uT94w4SqCLhJUQ1z e7k5Aj9tp1HnS5ZSX6+lOohMDI3iQ8h3XS4NGj4I962QIlovuCmAgkqzN/OeH4LV sxmqUEF/SeriryotcN/NCRjQSbmjwleVkmJ6pcEUTT3X+/EuFgOajj1/jm9ntrDv 4rsB/6CxZSC5+dW51L337GsjxPMiNBHhALXYuen/Xd35kU7YOLosFeFlednmBgYY otXb832XGmW2C65uM/+zWJHJ/DW0NXF2GZkvD15rd7SUdKQjyO9003TJFudx3w4W 9y9LXSIF7b7KW1SaAgHr3ayWaXsioaSOeBrlURG6o/eLfRfrrBiwAMNqn/TPwsP1 /S1rasMuleP9L8h3kSm0Z1+j7iZIDaCuIZ2fgP6G/UE= =fLK2 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2018-05-04-1 Security Update 2018-001 Swift 4.1.1 for Ubuntu 14.04
by Apple Product Security 04 May '18

04 May '18

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2018-05-04-1 Security Update 2018-001 Swift 4.1.1 for Ubuntu 14.04 Security Update 2018-001 Swift 4.1.1 for Ubuntu 14.04 is now available and addresses the following: Swift for Ubuntu Available for: Ubuntu 14.04 Not impacted: Ubuntu 16.04 and 16.10 Impact: A process may gain admin privileges and execute arbitrary code Description: An issue existed in specific versions of Swift on Ubuntu 14.04 where libraries are loaded with write and execute permissions. This issue was addressed with improved permissions. CVE-2018-4220: Apple Installation note: Security Update 2018-001 Swift 4.1.1 for Ubuntu 14.04 may be obtained from https://swift.org/download. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 and the Swift announcements section on the forum: https://forums.swift.org/c/general-announce This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlrsmUcpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbkbA// TuLWltNrBXakVq4NY1wBZ0P+/SYUlw312FHtWrtDcAKNykyfED9bA8AnG0Ux3d1g MdJqT9KkRLXOSunWgiXG8IpWH9KCApeWDV/AE4p6isgOzE4orx02QeHzu9zc7RN6 jBVlfJaGCpTzVuFJRiEimyupjbd5db33N8raRmLxMUKTn0jVjG6ARNS7G+rpUygE 4Dy/lwP05tLWffK1O+w0oihfGsxEl1xiNAcErHTk6Fb/ZVHiITXsuOw9E775dRsM 5fkuyVU6uyhzVNWXkJ9AhOlld7t6gBFNCADMsi+jSqT6EYCHKODBXrar0CfafrsP edAvUE6PopD2i5ee7msdB+WxTLf1J/WPqT4kyD9kD4SwPeE6eN8evTqubNsOF+jc cwhsgFuH34AvsoCea5i5v9mwLpjWodgq6OyMkF0Ee3shVx8HRo2Gm/sjj/THJq/G 76Wkfb2bOcVJ3ncDAHAHO3tWfrqZYD9+Eg5hQLwyRDpBKTBzl9R5yXQZFa0naLdC 1iEzXtom+IeXn9jYqE79qOUkBSMzZQ95j98CklKGfKMz8UtfOzM2+mmwCSx5CAwC H92XBJ7wMyg6EEgByPX89Y4oyg9Ng+reTtAQD2TC9rygEKh5LMJxlhCM+CLDWEqC ys0NCk7M9izqbAZ4zsf+D+Ml/4h71iDBae92JURjhas= =sqwr -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0