10.12.5 update beschikbaar en iOS 10.3.2
16 mei 2017 - 06:25   
geplaatst door: Spooter
https://support.apple.com/en-us/HT207706

The macOS Sierra 10.12.5 Update improves the stability, compatibility, and security of your Mac, and is recommended for all users.
This update:
Fixes an issue where audio may stutter when played through USB headphones.
Enhances compatibility of the Mac App Store with future software updates.
Adds support for media-free installation of Windows 10 Creators Update using Boot Camp.
Adds support for more digital camera RAW formats.
Resolves an issue, affecting some enterprise and education customers, that may cause the system date to be set to the year 2040.
Prevents a potential kernel panic when starting up from a NetInstall image. This fix is available when starting up from a NetInstall image created from the macOS 10.12.5 installer.

https://support.apple.com/en-us/HT207798

AVEVideoEncoder
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An application may be able to gain kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-6989: Adam Donenfeld (@doadam) of the Zimperium zLabs Team
CoreAudio
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-2502: Yangkang (@dnpushme) of Qihoo360 Qex Team
iBooks
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: A maliciously crafted book may open arbitrary websites without user permission
Description: A URL handling issue was addressed through improved state management.
CVE-2017-2497: Jun Kokatsu (@shhnjk)
iBooks
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with root privileges
Description: An issue existed within the path validation logic for symlinks. This issue was addressed through improved path sanitization.
CVE-2017-6981: evi1m0 of YSRC (sec.ly.com)
IOSurface
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An application may be able to gain kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-6979: Adam Donenfeld of Zimperium zLabs
Kernel
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A race condition was addressed through improved locking.
CVE-2017-2501: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-2507: Ian Beer of Google Project Zero
CVE-2017-6987: Patrick Wardle of Synack
Notifications
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An application may be able to cause a denial of service
Description: A denial of service issue was addressed through improved memory handling.
CVE-2017-6982: Vincent Desmurs (vincedes3), Sem Voigtlander (OxFEEDFACE), and Joseph Shenton of CoffeeBreakers
Safari
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Visiting a maliciously crafted webpage may lead to an application denial of service
Description: An issue in Safari's history menu was addressed through improved memory handling.
CVE-2017-2495: Tubasa Iinuma (@llamakko_cafe) of Gehirn Inc.
Security
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Update to the certificate trust policy
Description: A certificate validation issue existed in the handling of untrusted certificates. This issue was addressed through improved user handling of trust acceptance.
CVE-2017-2498: Andrew Jerman
SQLite
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A use after free issue was addressed through improved memory management.
CVE-2017-2513: found by OSS-Fuzz
SQLite
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A buffer overflow issue was addressed through improved memory handling.
CVE-2017-2518: found by OSS-Fuzz
CVE-2017-2520: found by OSS-Fuzz
SQLite
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-2519: found by OSS-Fuzz
SQLite
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved input validation.
CVE-2017-6983: Chaitin Security Research Lab (@ChaitinTech) working with Trend Micro's Zero Day Initiative
CVE-2017-6991: Chaitin Security Research Lab (@ChaitinTech) working with Trend Micro's Zero Day Initiative
TextInput
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Parsing maliciously crafted data may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-2524: Ian Beer of Google Project Zero
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
CVE-2017-2496: Apple
CVE-2017-2505: lokihardt of Google Project Zero
CVE-2017-2506: Zheng Huang of the Baidu Security Lab working with Trend Micro’s Zero Day Initiative
CVE-2017-2514: lokihardt of Google Project Zero
CVE-2017-2515: lokihardt of Google Project Zero
CVE-2017-2521: lokihardt of Google Project Zero
CVE-2017-2525: Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative
CVE-2017-2526: Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative
CVE-2017-2530: an anonymous researcher
CVE-2017-2531: lokihardt of Google Project Zero
CVE-2017-2538: Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative
CVE-2017-2539: Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative
CVE-2017-2544: 360 Security (@mj0011sec) working with Trend Micro's Zero Day Initiative
CVE-2017-2547: lokihardt of Google Project Zero, Team Sniper (Keen Lab and PC Mgr) working with Trend Micro's Zero Day Initiative
CVE-2017-6980: lokihardt of Google Project Zero
CVE-2017-6984: lokihardt of Google Project Zero
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A logic issue existed in the handling of WebKit Editor commands. This issue was addressed with improved state management.
CVE-2017-2504: lokihardt of Google Project Zero
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A logic issue existed in the handling of WebKit container nodes. This issue was addressed with improved state management.
CVE-2017-2508: lokihardt of Google Project Zero
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A logic issue existed in the handling of pageshow events. This issue was addressed with improved state management.
CVE-2017-2510: lokihardt of Google Project Zero
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A logic issue existed in the handling of WebKit cached frames. This issue was addressed with improved state management.
CVE-2017-2528: lokihardt of Google Project Zero
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues with addressed through improved memory handling.
CVE-2017-2536: Samuel Groß and Niklas Baumstark working with Trend Micro's Zero Day Initiative
WebKit
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: Processing maliciously crafted web content may lead to universal cross site scripting
Description: A logic issue existed in frame loading. This issue was addressed with improved state management.
CVE-2017-2549: lokihardt of Google Project Zero
WebKit Web Inspector
Available for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation
Impact: An application may be able to execute unsigned code
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-2499: George Dan (@theninjaprawn)

(Bewerkt door Spooter om 6:36, 16-05-2017)

10.12.5 update beschikbaar en iOs 10.3.2
16 mei 2017 - 06:45    reactie #1
geplaatst door: Pieterr
Vooral de lengte van de CVE issues lijst is indrukwekkend. Het lijkt erop of er alleen maar meer (potentiële) lekken gevonden worden vandaag de dag.

Een overzicht van Microsoft en Adobe van de maand mei, ook al zo'n lange lijst:
https://www.zerodayinitiative.com/blog/2017/5/5/the-may-2017-security-update-review

"One experiment is worth a thousand expert opinions."
10.12.5 update beschikbaar en iOs 10.3.2
16 mei 2017 - 08:28    reactie #2
geplaatst door: Spooter
Er zijn weer wat bijeenkomsten geweest waarbij 'codekunstenaars' het eea hebben 'blootgelegd' en waar Apple nu 'oplossingen' voor uitgebracht heeft  :wink:
10.12.5 update beschikbaar en iOs 10.3.2
16 mei 2017 - 14:42    reactie #3
geplaatst door: cyrano

Citaat
Pieterr om 6:45, 16-05-2017
Vooral de lengte van de CVE issues lijst is indrukwekkend. Het lijkt erop of er alleen maar meer (potentiële) lekken gevonden worden vandaag de dag.

Een overzicht van Microsoft en Adobe van de maand mei, ook al zo'n lange lijst:
https://www.zerodayinitiative.com/blog/2017/5/5/the-may-2017-security-update-review

Wat wil je, 't moet alsmaar sneller. Je maakt geen secure OS op een jaar. En Apple releaset elk jaar een nieuw OS?

Waarom? Op weg naar wat?

I'd tell you a UDP joke but you might not get it.
10.12.5 update beschikbaar en iOs 10.3.2
16 mei 2017 - 15:07    reactie #4
geplaatst door: het ModeratorTeam
Inmiddels hebben we hier twee nieuwsberichten over (met naamsvermelding), zowel over iOS als over Sierra.

Om dubbele draadjes te voorkomen zetten we hier een slotje op.

met vriendelijke groet, het ModeratorTeam