Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.1247
Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6
7 May 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Safari
Publisher: Apple
Operating System: OS X
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2015-1156 CVE-2015-1155 CVE-2015-1154
CVE-2015-1153 CVE-2015-1152
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6
Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 are now available and
address the following:
WebKit
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.3
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2015-1152 : Apple
CVE-2015-1153 : Apple
CVE-2015-1154 : Apple
WebKit History
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.3
Impact: Visiting a maliciously crafted website may compromise user
information on the filesystem
Description: A state management issue existed in Safari that allowed
unprivileged origins to access contents on the filesystem. This issue
was addressed through improved state management.
CVE-ID
CVE-2015-1155 : Joe Vennix of Rapid7 Inc. working with HP's Zero Day
Initiative
WebKit Page Loading
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5,
and OS X Yosemite v10.10.3
Impact: Visiting a malicious website by clicking a link may lead to
user interface spoofing
Description: An issue existed in the handling of the rel attribute
in anchor elements. Target objects could get unauthorized access to
link objects. This issue was addressed through improved link type
adherence.
CVE-ID
CVE-2015-1156 : Zachary Durber of Moodle
Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 may be obtained from
the Mac App Store.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJVSmEJAAoJEBcWfLTuOo7tixsP/1BA4ipZ+MJwPqMEkVmYHyCc
4RtNYjWB6gX7yRLA9x3FdSXo1XG9C+1mtnWV3Acp2sP/mtmhH9yjUrayqYANsBoe
Qrunfhhhx19DLYJ4989Y2HzWa8TJCYf/48Sh8PS5Jaf0FXdEUsqy/vBv/XGZLLrD
k60uzyLswMp12OVC14c9Ueq7dMWXscebl7CGkKxuBAfvYpcZdhbmDWg/kkRGruZJ
Ezh6m4YAzBSaeuoibKKZbAVbHlH+xW8wThw3GHfnwfBvX03ZsgH5mdw2UWPgT+gG
/wrllHKG/qpaPeS0WZDVbI8NxmQP/YK+Fall2yqAUwDX7xj9VDZAKVElst9CWl6U
Y+jn8+MxTPLqAAnmvl/0zcsU5qR/DzsbqT6MVCDH0PqPspdzHfyT6d7sT/fBN2Ri
ti3uw7YmQCCQzi16vcGZnFjlIMDHB+hp5slp7hiVvAjixclYmRE62WME9VT/lZBW
Kqs+OE6ZQ4jsHX1uhGNdQzGgQbwHtoNkh8rge+VvMQZwMV/IMW9hnTzKStEOPpmz
EZuJRsVA7ZNaVd+y22Vfb8jyrY7BLiALKGpPaZNkmkF/hRgQHsXiXwC69np/6Jcg
2fy1uEt7eWKNPzQo1oUMtJ1jLzBMIBZoH4UpbpFZaHfHx/KYl8Pi8IahK7PT/r96
d2NeGKt3ZU8rm9473KsB
=EyH2
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVUq61BLndAQH1ShLAQLTbw/9FEmQTkb+ShJIILjMyMhY1DxleXLRj4Wx
tpBE3AFuaonJ2noUv8DVipgXw64PuAhu10oGjK1yEnycxDyiOv08Yy54A/oDl/MP
Xsh9rc4wcu92LW6Cm1ymTyzMp4jKryha2VrOzDHOOxnrXArHegN+w0qTvXyCRsc0
bRFOLtDz3TtuDGqSOjEiXNnZSiRPAD1JMMtStTxt+zdPcVZ+WM7DBt0Z9dcGG3+K
jijf2JIqflyH7BOEQE3q2UOtHfgSs9z335AvT7ov9opalfW+ROxcKlpeUjr8GesI
4Pxf+dbA4UzK1bmec8VnhHRVrsbTJg5foeijIWKhhKKNZoUGz3q7D6Rw5BdrFD2b
X2QESLzmrCIDSTbEZLAz1X5MdEXKcrUgnVMyVJa1fQ7nzJ2UCGA8mONeAVv65tot
Na9PgdHx5CyJsBKHZdvgb2fN3Pc0S7qKjooVjKcYZ6GjQGC7Mr0tV5sRFkx+2NXv
puu4/Ffal11r3jm0gj/J60s3A6oETMX8/EhrMSk4vmXzpW5g8DbTx0xfG8XF3yFa
whH1M7/kRTtsnS+tZx2KnuK6NPxZrYOuaSuiSg9WdDplfVnurB7srtOvdl4lYEBH
ee1fKB8vZ618HbYxa/pQtcJE7+G76HoCjjZwQ0OadBCvDcbseh8HRkFeRDjkO7ve
X+0fDfyq6zo=
=Sycb
-----END PGP SIGNATURE-----