exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Apple Security Advisory 2018-1-23-2

Apple Security Advisory 2018-1-23-2
Posted Jan 24, 2018
Authored by Apple | Site apple.com

Apple Security Advisory 2018-1-23-2 - macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan are now available and address memory corruption, race condition, and various other vulnerabilities.

tags | advisory, vulnerability
systems | apple
advisories | CVE-2017-5754, CVE-2017-8817, CVE-2018-4082, CVE-2018-4084, CVE-2018-4085, CVE-2018-4086, CVE-2018-4088, CVE-2018-4089, CVE-2018-4090, CVE-2018-4091, CVE-2018-4092, CVE-2018-4093, CVE-2018-4094, CVE-2018-4096, CVE-2018-4097, CVE-2018-4098, CVE-2018-4100
SHA-256 | 8c1805de61064d31f8f0e1edc053ec2d320938ca52904bf91ded86f4bd059635

Apple Security Advisory 2018-1-23-2

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

APPLE-SA-2018-1-23-2 macOS High Sierra 10.13.3,
Security Update 2018-001 Sierra,
and Security Update 2018-001 El Capitan

macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and
Security Update 2018-001 El Capitan are now available and address
the following:

Audio
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University

curl
Available for: macOS High Sierra 10.13.2
Impact: Multiple issues in curl
Description: An out-of-bounds read issue existed in the curl. This
issue was addressed through improved bounds checking.
CVE-2017-8817: found by OSS-Fuzz

IOHIDFamily
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6,
OS X El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4098: Siguza

Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via
a side-channel analysis of the data cache.
CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of
Graz University of Technology; Michael Schwarz of Graz University of
Technology; Daniel Gruss of Graz University of Technology;
Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus
Technology GmbH; Stefan Mangard of Graz University of Technology;
Paul Kocher; Daniel Genkin of University of Pennsylvania and
University of Maryland; Yuval Yarom of University of Adelaide and
Data61; and Mike Hamburg of Rambus (Cryptography Research Division)

Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero

Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher

Kernel
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6,
OS X El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google

Kernel
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A logic issue was addressed with improved validation.
CVE-2018-4097: Resecurity, Inc.

Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero

LinkPresentation
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6.2
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)

QuartzCore
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6,
OS X El Capitan 10.11.6
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue existed in the processing of
web content. This issue was addressed through improved input
validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative

Sandbox
Available for: macOS High Sierra 10.13.2
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed through additional sandbox
restrictions.
CVE-2018-4091: Alex Gaynor of Mozilla

Security
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints. This issue was addressed through improved trust
evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix

WebKit
Available for: macOS High Sierra 10.13.2
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz

Wi-Fi
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6,
OS X El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4084: Hyung Sup Lee of Minionz, You Chan Lee of Hanyang
University

Installation note:

macOS High Sierra 10.13.3, Security Update 2018-001 Sierra,
and Security Update 2018-001 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpnnmApHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEZaqg/8
DAjzEHmWMZxkSl88DnX/Y9x39DQ1eV6O0Bsg/WQ2r6wZlRDnBOYdJtgJU0I9MjgT
JjOj6M/l+YkVS3EJHcdQqAZ6RfSSMvIcRieHJ0Lfj6bfohKRLJxuloFVKar3lAsY
fIdzqlFKqWvPY6Neto2iR7ZhTWDW7QiVwbgSR1fleEWEglWtTeJjL6mff73Mqexh
7VngVFIicrbjoFD7uY2dctgkP+no3dcFieyRWF/z8OAmAOIkAc/KMqFyj22DBDq5
hH1j07Eo0RLKMT+nPq3Vgir5JVVR68M4UvDnSDXGHmTRYaM2BT8osWqlehgFQ52F
JhqAsJsKP1Mc9WZkly8OvBbZHJcIJryTSqytOOZRQuvg6fXHPOezajcpThTntGiI
/YcmaFIt8bZ8c0GbQXTMY8YCJEHtG3zb/z+Wf0sABfzbtCt48e5CQD5HDsoZyiML
J84Sbs1Lb5XFYsdZg5iUFukIJRqYwaf69BUgMmFPTOxkBL/KH7m4BmUtLeiStLYN
ykdW2TQFEbM6ojPL9HrAyho0wdX2/G4jiemAk22fb/XQ6q9+57RyduE/MDiFW93a
2XcIzxlsRk37ISIPyEkQTF/L/DTMdnhgI+ZIwmaMwU8Hd48MMMg6MIWYctefvnyB
a1pVFFlwHCfxBWYSVI2fkKwExlNNYXCOjGsN7TSBfNc=
=pc7O
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close