maxim
@maxim_apps
Como sabéis, hace muy poco el equipo de seguridad de Google publicó la actualización OS X 10.10.3 que ha distribuido Apple por sus canales habituales.
Concretamente está desarrollada por el equipo de seguridad de Google, Google Project Zero de la mano de Ian Beer. La actualización OS X 10.10.3 es un autentico service pack lleno de parches de seguridad, aquí hay más parches que en un taller de bicicletas.
Importante actualizar porque cualquiera puede escalar privilegios de seguridad, un resumen de los parches incluyendo los nuevos kext graficos que no aportan mejor rendimiento porque como sabes, OS X carece de motor gráfico, pero si aporta seguridad que hasta se podian explotar los kext gráficos, ver para creer
Admin Framework
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A process may gain admin privileges without properly authenticating
Description: An issue existed when checking XPC entitlements. This issue was addressed with improved entitlement checking.
apache
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Multiple vulnerabilities in Apache
Description: Multiple vulnerabilities existed in Apache versions prior to 2.4.10 and 2.2.29, including one that may allow a remote attacker to execute arbitrary code. These issues were addressed by updating Apache to versions 2.4.10 and 2.2.29
ATS
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: Multiple input validation issues existed in fontd. These issues were addressed through improved input validation.
CVE-2015-1131 : Ian Beer of Google Project Zero
Certificate Trust Policy
Impact: Update to the certificate trust policy
Description: The certificate trust policy was updated. View the complete list of certificates.
CFNetwork HTTPProtocol
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Cookies belonging to one origin may be sent to another origin
Description: A cross-domain cookie issue existed in redirect handling. Cookies set in a redirect response could be passed on to a redirect target belonging to another origin. The issue was address through improved handling of redirects.
CVE-ID
CVE-2015-1089 : Niklas Keller
CFNetwork Session
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Authentication credentials may be sent to a server on another origin
Description: A cross-domain HTTP request headers issue existed in redirect handling. HTTP request headers sent in a redirect response could be passed on to another origin. The issue was addressed through improved handling of redirects.
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: An input validation issue existed within URL processing. This issue was addressed through improved URL validation.
CoreAnimation
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: A use-after-free issue existed in CoreAnimation. This issue was addressed through improved mutex management.
FontParser
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: Multiple memory corruption issues existed in the processing of font files. These issues were addressed through improved bounds checking.
Graphics Driver
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A NULL pointer dereference existed in NVIDIA graphics driver's handling of certain IOService userclient types. This issue was addressed through additional context validation.
Hypervisor
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A local application may be able to cause a denial of service
Description: An input validation issue existed in the hypervisor framework. This issue was addressed through improved input validation.
ImageIO
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Processing a maliciously crafted .sgi file may lead to arbitrary code execution
Description: A memory corruption issue existed in the handling of .sgi files. This issue was addressed through improved bounds checking.
IOHIDFamily
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A malicious HID device may be able to cause arbitrary code execution
Description: A memory corruption issue existed in an IOHIDFamily API. This issue was addressed through improved memory handling.
IOHIDFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A buffer overflow issue existed in IOHIDFamily. This issue was addressed through improved memory handling.
IOHIDFamily
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to determine kernel memory layout
Description: An issue existed in IOHIDFamily that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking.
IOHIDFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A heap buffer overflow existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved bounds checking.
CVE-2014-4404 : Ian Beer of Google Project Zero
IOHIDFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A null pointer dereference existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved validation of IOHIDFamily key-mapping properties.
CVE-2014-4405 : Ian Beer of Google Project Zero
IOHIDFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5
Impact: A user may be able to execute arbitrary code with system privileges
Description: An out-of-bounds write issue exited in the IOHIDFamily driver. The issue was addressed through improved input validation.
Kernel
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to cause unexpected system shutdown
Description: An issue existed in the handling of virtual memory operations within the kernel. The issue is fixed through improved handling of the mach_vm_read operation.
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to cause a system denial of service
Description: A race condition existed in the kernel's setreuid system call. This issue was addressed through improved state management.
CVE-ID
CVE-2015-1099 : Mark Mentovai of Google Inc.
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local application may escalate privileges using a compromised service intended to run with reduced privileges
Description: setreuid and setregid system calls failed to drop privileges permanently. This issue was addressed by correctly dropping privileges.
CVE-2015-1117 : Mark Mentovai of Google Inc.
Kernel
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: An attacker with a privileged network position may be able to redirect user traffic to arbitrary hosts
Description: ICMP redirects were enabled by default on OS X. This issue was addressed by disabling ICMP redirects.
Kernel
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: An attacker with a privileged network position may be able to cause a denial of service
Description: A state inconsistency existed in the processing of TCP headers. This issue was addressed through improved state handling.
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to cause unexpected system termination or read kernel memory
Description: A out of bounds memory access issue existed in the kernel. This issue was addressed through improved memory handling.
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A remote attacker may be able to bypass network filters
Description: The system would treat some IPv6 packets from remote network interfaces as local packets. The issue was addressed by rejecting these packets.
CVE-ID
CVE-2015-1104 : Stephen Roettger of the Google Security Team
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.
Kernel
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A remote attacker may be able to cause a denial of service
Description: A state inconsistency issue existed in the handling of TCP out of band data. This issue was addressed through improved state management.
LaunchServices
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to cause the Finder to crash
Description: An input validation issue existed in LaunchServices's handling of application localization data. This issue was addressed through improved validation of localization data.
LaunchServices
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A type confusion issue existed in LaunchServices's handling of localized strings. This issue was addressed through additional bounds checking.
libnetcore
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Processing a maliciously crafted configuration profile may lead to unexpected application termination
Description: A memory corruption issue existed in the handling of configuration profiles. This issue was addressed through improved bounds checking.
ntp
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A remote attacker may brute force ntpd authentication keys
Description: The config_auth function in ntpd generated a weak key when an authentication key was not configured. This issue was addressed by improved key generation.
OpenLDAP
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A remote unauthenticated client may be able to cause a denial of service
Description: Multiple input validation issues existed in OpenLDAP. These issues were addressed by improved input validation.
OpenSSL
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Multiple vulnerabilities in OpenSSL
Description: Multiple vulnerabilities existed in OpenSSL 0.9.8zc, including one that may allow an attacker to intercept connections to a server that supports export-grade ciphers. These issues were addressed by updating OpenSSL to version 0.9.8zd.
Open Directory Client
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A password might be sent unencrypted over the network when using Open Directory from OS X Server
Description: If an Open Directory client was bound to an OS X Server but did not install the certificates of the OS X Server, and then a user on that client changed their password, the password change request was sent over the network without encryption. This issue was addressed by having the client require encryption for this case.
PHP
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Multiple vulnerabilities in PHP
Description: Multiple vulnerabilities existed in PHP versions prior to 5.3.29, 5.4.38, and 5.5.20, including one which may have led to arbitrary code execution. This update addresses the issues by updating PHP to versions 5.3.29, 5.4.38, and 5.5.20.
QuickLook
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Opening a maliciously crafted iWork file may lead to arbitrary code execution
Description: A memory corruption issue existed in the handling of iWork files. This issue was addressed through improved memory handling.
SceneKit
Available for: OS X Mountain Lion v10.8.5
Impact: Viewing a maliciously crafted Collada file may lead to arbitrary code execution
Description: A heap buffer overflow existed in SceneKit's handling of Collada files. Viewing a maliciously crafted Collada file may have led to arbitrary code execution. This issue was addressed through improved validation of accessor elements.
CVE-ID
CVE-2014-8830 : Jose Duart of Google Security Team
Screen Sharing
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A user's password may be logged to a local file
Description: In some circumstances, Screen Sharing may log a user's password that is not readable by other users on the system. This issue was addressed by removing logging of credential.
Security - Code Signing
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Tampered applications may not be prevented from launching
Description: Applications containing specially crafted bundles may have been able to launch without a completely valid signature. This issue was addressed by adding additional checks.
UniformTypeIdentifiers
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A buffer overflow existed in the way Uniform Type Identifiers were handled. This issue was addressed with improved bounds checking.
WebKit
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: A memory corruption issue existed in WebKit. This issues was addressed through improved memory handling.
Con todo eso si aun no has actualizado a OS X 10.10.3 es que eres un valiente
Concretamente está desarrollada por el equipo de seguridad de Google, Google Project Zero de la mano de Ian Beer. La actualización OS X 10.10.3 es un autentico service pack lleno de parches de seguridad, aquí hay más parches que en un taller de bicicletas.
Importante actualizar porque cualquiera puede escalar privilegios de seguridad, un resumen de los parches incluyendo los nuevos kext graficos que no aportan mejor rendimiento porque como sabes, OS X carece de motor gráfico, pero si aporta seguridad que hasta se podian explotar los kext gráficos, ver para creer
Admin Framework
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A process may gain admin privileges without properly authenticating
Description: An issue existed when checking XPC entitlements. This issue was addressed with improved entitlement checking.
apache
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Multiple vulnerabilities in Apache
Description: Multiple vulnerabilities existed in Apache versions prior to 2.4.10 and 2.2.29, including one that may allow a remote attacker to execute arbitrary code. These issues were addressed by updating Apache to versions 2.4.10 and 2.2.29
ATS
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: Multiple input validation issues existed in fontd. These issues were addressed through improved input validation.
CVE-2015-1131 : Ian Beer of Google Project Zero
Certificate Trust Policy
Impact: Update to the certificate trust policy
Description: The certificate trust policy was updated. View the complete list of certificates.
CFNetwork HTTPProtocol
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Cookies belonging to one origin may be sent to another origin
Description: A cross-domain cookie issue existed in redirect handling. Cookies set in a redirect response could be passed on to a redirect target belonging to another origin. The issue was address through improved handling of redirects.
CVE-ID
CVE-2015-1089 : Niklas Keller
CFNetwork Session
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Authentication credentials may be sent to a server on another origin
Description: A cross-domain HTTP request headers issue existed in redirect handling. HTTP request headers sent in a redirect response could be passed on to another origin. The issue was addressed through improved handling of redirects.
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: An input validation issue existed within URL processing. This issue was addressed through improved URL validation.
CoreAnimation
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: A use-after-free issue existed in CoreAnimation. This issue was addressed through improved mutex management.
FontParser
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: Multiple memory corruption issues existed in the processing of font files. These issues were addressed through improved bounds checking.
Graphics Driver
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A NULL pointer dereference existed in NVIDIA graphics driver's handling of certain IOService userclient types. This issue was addressed through additional context validation.
Hypervisor
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A local application may be able to cause a denial of service
Description: An input validation issue existed in the hypervisor framework. This issue was addressed through improved input validation.
ImageIO
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Processing a maliciously crafted .sgi file may lead to arbitrary code execution
Description: A memory corruption issue existed in the handling of .sgi files. This issue was addressed through improved bounds checking.
IOHIDFamily
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A malicious HID device may be able to cause arbitrary code execution
Description: A memory corruption issue existed in an IOHIDFamily API. This issue was addressed through improved memory handling.
IOHIDFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A buffer overflow issue existed in IOHIDFamily. This issue was addressed through improved memory handling.
IOHIDFamily
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to determine kernel memory layout
Description: An issue existed in IOHIDFamily that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking.
IOHIDFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A heap buffer overflow existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved bounds checking.
CVE-2014-4404 : Ian Beer of Google Project Zero
IOHIDFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5
Impact: A malicious application may be able to execute arbitrary code with system privileges
Description: A null pointer dereference existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved validation of IOHIDFamily key-mapping properties.
CVE-2014-4405 : Ian Beer of Google Project Zero
IOHIDFamily
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5
Impact: A user may be able to execute arbitrary code with system privileges
Description: An out-of-bounds write issue exited in the IOHIDFamily driver. The issue was addressed through improved input validation.
Kernel
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to cause unexpected system shutdown
Description: An issue existed in the handling of virtual memory operations within the kernel. The issue is fixed through improved handling of the mach_vm_read operation.
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to cause a system denial of service
Description: A race condition existed in the kernel's setreuid system call. This issue was addressed through improved state management.
CVE-ID
CVE-2015-1099 : Mark Mentovai of Google Inc.
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local application may escalate privileges using a compromised service intended to run with reduced privileges
Description: setreuid and setregid system calls failed to drop privileges permanently. This issue was addressed by correctly dropping privileges.
CVE-2015-1117 : Mark Mentovai of Google Inc.
Kernel
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: An attacker with a privileged network position may be able to redirect user traffic to arbitrary hosts
Description: ICMP redirects were enabled by default on OS X. This issue was addressed by disabling ICMP redirects.
Kernel
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: An attacker with a privileged network position may be able to cause a denial of service
Description: A state inconsistency existed in the processing of TCP headers. This issue was addressed through improved state handling.
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to cause unexpected system termination or read kernel memory
Description: A out of bounds memory access issue existed in the kernel. This issue was addressed through improved memory handling.
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A remote attacker may be able to bypass network filters
Description: The system would treat some IPv6 packets from remote network interfaces as local packets. The issue was addressed by rejecting these packets.
CVE-ID
CVE-2015-1104 : Stephen Roettger of the Google Security Team
Kernel
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.
Kernel
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A remote attacker may be able to cause a denial of service
Description: A state inconsistency issue existed in the handling of TCP out of band data. This issue was addressed through improved state management.
LaunchServices
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to cause the Finder to crash
Description: An input validation issue existed in LaunchServices's handling of application localization data. This issue was addressed through improved validation of localization data.
LaunchServices
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A type confusion issue existed in LaunchServices's handling of localized strings. This issue was addressed through additional bounds checking.
libnetcore
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Processing a maliciously crafted configuration profile may lead to unexpected application termination
Description: A memory corruption issue existed in the handling of configuration profiles. This issue was addressed through improved bounds checking.
ntp
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A remote attacker may brute force ntpd authentication keys
Description: The config_auth function in ntpd generated a weak key when an authentication key was not configured. This issue was addressed by improved key generation.
OpenLDAP
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A remote unauthenticated client may be able to cause a denial of service
Description: Multiple input validation issues existed in OpenLDAP. These issues were addressed by improved input validation.
OpenSSL
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Multiple vulnerabilities in OpenSSL
Description: Multiple vulnerabilities existed in OpenSSL 0.9.8zc, including one that may allow an attacker to intercept connections to a server that supports export-grade ciphers. These issues were addressed by updating OpenSSL to version 0.9.8zd.
Open Directory Client
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A password might be sent unencrypted over the network when using Open Directory from OS X Server
Description: If an Open Directory client was bound to an OS X Server but did not install the certificates of the OS X Server, and then a user on that client changed their password, the password change request was sent over the network without encryption. This issue was addressed by having the client require encryption for this case.
PHP
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Multiple vulnerabilities in PHP
Description: Multiple vulnerabilities existed in PHP versions prior to 5.3.29, 5.4.38, and 5.5.20, including one which may have led to arbitrary code execution. This update addresses the issues by updating PHP to versions 5.3.29, 5.4.38, and 5.5.20.
QuickLook
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Opening a maliciously crafted iWork file may lead to arbitrary code execution
Description: A memory corruption issue existed in the handling of iWork files. This issue was addressed through improved memory handling.
SceneKit
Available for: OS X Mountain Lion v10.8.5
Impact: Viewing a maliciously crafted Collada file may lead to arbitrary code execution
Description: A heap buffer overflow existed in SceneKit's handling of Collada files. Viewing a maliciously crafted Collada file may have led to arbitrary code execution. This issue was addressed through improved validation of accessor elements.
CVE-ID
CVE-2014-8830 : Jose Duart of Google Security Team
Screen Sharing
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: A user's password may be logged to a local file
Description: In some circumstances, Screen Sharing may log a user's password that is not readable by other users on the system. This issue was addressed by removing logging of credential.
Security - Code Signing
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: Tampered applications may not be prevented from launching
Description: Applications containing specially crafted bundles may have been able to launch without a completely valid signature. This issue was addressed by adding additional checks.
UniformTypeIdentifiers
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.2
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A buffer overflow existed in the way Uniform Type Identifiers were handled. This issue was addressed with improved bounds checking.
WebKit
Available for: OS X Yosemite v10.10 to v10.10.2
Impact: Visiting a maliciously crafted website may lead to arbitrary code execution
Description: A memory corruption issue existed in WebKit. This issues was addressed through improved memory handling.
Con todo eso si aun no has actualizado a OS X 10.10.3 es que eres un valiente
