—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512

APPLE-SA-2017-03-27-3 macOS Sierra 10.12.4, Security Update
2017-001 El Capitan, and Security Update 2017-001 Yosemite

macOS Sierra 10.12.4, Security Update 2017-001 El Capitan,
and Security Update 2017-001 Yosemite are now available and
address the following:

apache
Available for: macOS Sierra 10.12.3
Impact: A remote attacker may be able to cause a denial of service
Description: Multiple issues existed in Apache before 2.4.25. These
were addressed by updating LibreSSL to version 2.4.25.
CVE-2016-0736: an anonymous researcher
CVE-2016-2161: an anonymous researcher
CVE-2016-5387: an anonymous researcher
CVE-2016-8740: an anonymous researcher
CVE-2016-8743: an anonymous researcher

apache_mod_php
Available for: macOS Sierra 10.12.3
Impact: Multiple issues existed in PHP before 5.6.30
Description: Multiple issues existed in PHP before 5.6.30. These were
addressed by updating PHP to version 5.6.30.
CVE-2016-10158
CVE-2016-10159
CVE-2016-10160
CVE-2016-10161
CVE-2016-9935

AppleGraphicsPowerManagement
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A race condition was addressed through improved memory
handling.
CVE-2017-2421: @cocoahuke

AppleRAID
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A use after free issue was addressed through improved
memory management.
CVE-2017-2438: sss and Axis of 360Nirvanteam

Audio
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2430: an anonymous researcher working with Trend Micro’s
Zero Day Initiative
CVE-2017-2462: an anonymous researcher working with Trend Micro’s
Zero Day Initiative

Bluetooth
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2420: Pekka Oikarainen, Matias Karhumaa and Marko Laakso of
Synopsys Software Integrity Group

Bluetooth
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2427: Axis and sss of Qihoo 360 Nirvan Team

Bluetooth
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A use after free issue was addressed through improved
memory management.
CVE-2017-2449: sss and Axis from 360NirvanTeam

Carbon
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted .dfont file may lead to
arbitrary code execution
Description: A buffer overflow existed in the handling of font files.
This issue was addressed through improved bounds checking.
CVE-2017-2379: riusksk (泉哥) of Tencent Security Platform
Department, John Villamil, Doyensec

CoreGraphics
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted image may lead to a denial
of service
Description: An infinite recursion was addressed through improved
state management.
CVE-2017-2417: riusksk (泉哥) of Tencent Security Platform
Department

CoreMedia
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted .mov file may lead to
arbitrary code execution
Description: A memory corruption issue existed in the handling of
.mov files. This issue was addressed through improved memory
management.
CVE-2017-2431: kimyok of Tencent Security Platform Department

CoreText
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2435: John Villamil, Doyensec

CoreText
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed through improved
input validation.
CVE-2017-2450: John Villamil, Doyensec

CoreText
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2017-2461: Isaac Archambault of IDAoADI, an anonymous researcher

curl
Available for: macOS Sierra 10.12.3
Impact: Maliciously crafted user input to libcurl API may allow
arbitrary code execution
Description: A buffer overflow was addressed through improved bounds
checking.
CVE-2016-9586: Daniel Stenberg of Mozilla

EFI
Available for: macOS Sierra 10.12.3
Impact: A malicious Thunderbolt adapter may be able to recover the
FileVault 2 encryption password
Description: An issue existed in the handling of DMA. This issue was
addressed by enabling VT-d in EFI.
CVE-2016-7585: Ulf Frisk (@UlfFrisk)

FinderKit
Available for: macOS Sierra 10.12.3
Impact: Permissions may unexpectedly reset when sending links
Description: A permission issue existed in the handling of the Send
Link feature of iCloud Sharing. This issue was addressed through
improved permission controls.
CVE-2017-2429

FontParser
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed through
improved input validation.
CVE-2017-2406: riusksk (泉哥) of Tencent Security Platform
Department
CVE-2017-2487: riusksk (泉哥) of Tencent Security Platform
Department

FontParser
Available for: macOS Sierra 10.12.3
Impact: Parsing a maliciously crafted font file may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues were addressed through
improved input validation.
CVE-2017-2407: riusksk (泉哥) of Tencent Security Platform
Department

FontParser
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted font may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed through improved
input validation.
CVE-2017-2439: John Villamil, Doyensec

HTTPProtocol
Available for: macOS Sierra 10.12.3
Impact: A malicious HTTP/2 server may be able to cause undefined
behavior
Description: Multiple issues existed in nghttp2 before 1.17.0. These
were addressed by updating LibreSSL to version 1.17.0.
CVE-2017-2428

Hypervisor
Available for: macOS Sierra 10.12.3
Impact: Applications using the Hypervisor framework may unexpectedly
leak the CR8 control register between guest and host
Description: An information leakage issue was addressed through
improved state management.
CVE-2017-2418: Alex Fishman and Izik Eidus of Veertu Inc.

iBooks
Available for: macOS Sierra 10.12.3
Impact: Parsing a maliciously crafted iBooks file may lead to local
file disclosure
Description: An information leak existed in the handling of file
URLs. This issue was addressed through improved URL handling.
CVE-2017-2426: Craig Arendt of Stratum Security, Jun Kokatsu
(@shhnjk)

ImageIO
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2416: Qidan He (何淇丹, @flanker_hqd) of KeenLab, Tencent

ImageIO
Available for: macOS Sierra 10.12.3, OS X El Capitan v10.11.6,
and OS X Yosemite v10.10.5
Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2432: an anonymous researcher working with Trend Micro’s
Zero Day Initiative

ImageIO
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2467

ImageIO
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted image may lead to unexpected
application termination
Description: An out-of-bound read existed in LibTIFF versions before
4.0.7. This was addressed by updating LibTIFF in ImageIO to version
4.0.7.
CVE-2016-3619

Intel Graphics Driver
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2443: Ian Beer of Google Project Zero

IOATAFamily
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2408: Yangkang (@dnpushme) of Qihoo360 Qex Team

IOFireWireAVC
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2436: Orr A, IBM Security

IOFireWireAVC
Available for: macOS Sierra 10.12.3
Impact: A local attacker may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2437: Benjamin Gnahm (@mitp0sh) of Blue Frost Security

IOFireWireFamily
Available for: macOS Sierra 10.12.3
Impact: An application may be able to cause a denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2017-2388: Brandon Azad, an anonymous researcher

Kernel
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2398: Lufeng Li of Qihoo 360 Vulcan Team
CVE-2017-2401: Lufeng Li of Qihoo 360 Vulcan Team

Kernel
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-2410: Apple

Kernel
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: An integer overflow was addressed through improved input
validation.
CVE-2017-2440: an anonymous researcher

Kernel
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with root privileges
Description: A race condition was addressed through improved memory
handling.
CVE-2017-2456: lokihardt of Google Project Zero

Kernel
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A use after free issue was addressed through improved
memory management.
CVE-2017-2472: Ian Beer of Google Project Zero

Kernel
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2017-2473: Ian Beer of Google Project Zero

Kernel
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: An off-by-one issue was addressed through improved
bounds checking.
CVE-2017-2474: Ian Beer of Google Project Zero

Kernel
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A race condition was addressed through improved locking.
CVE-2017-2478: Ian Beer of Google Project Zero

Kernel
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A buffer overflow issue was addressed through improved
memory handling.
CVE-2017-2482: Ian Beer of Google Project Zero
CVE-2017-2483: Ian Beer of Google Project Zero

Keyboards
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code
Description: A buffer overflow was addressed through improved bounds
checking.
CVE-2017-2458: Shashank (@cyberboyIndia)

libarchive
Available for: macOS Sierra 10.12.3
Impact: A local attacker may be able to change file system
permissions on arbitrary directories
Description: A validation issue existed in the handling of symlinks.
This issue was addressed through improved validation of symlinks.
CVE-2017-2390: Omer Medan of enSilo Ltd

libc++abi
Available for: macOS Sierra 10.12.3
Impact: Demangling a malicious C++ application may lead to arbitrary
code execution
Description: A use after free issue was addressed through improved
memory management.
CVE-2017-2441

LibreSSL
Available for: macOS Sierra 10.12.3, and OS X El Capitan v10.11.6
Impact: A local user may be able to leak sensitive user information
Description: A timing side channel allowed an attacker to recover
keys. This issue was addressed by introducing constant time
computation.
CVE-2016-7056: Cesar Pereida García and Billy Brumley (Tampere
University of Technology)

MCX Client
Available for: macOS Sierra 10.12.3
Impact: Removing a configuration profile with multiple payloads may
not remove Active Directory certificate trust
Description: An issue existed in profile uninstallation. This issue
was addressed through improved cleanup.
CVE-2017-2402: an anonymous researcher

Menus
Available for: macOS Sierra 10.12.3
Impact: An application may be able to disclose process memory
Description: An out-of-bounds read was addressed through improved
input validation.
CVE-2017-2409: Sergey Bylokhov

Multi-Touch
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2422: @cocoahuke

OpenSSH
Available for: macOS Sierra 10.12.3
Impact: Multiple issues in OpenSSH
Description: Multiple issues existed in OpenSSH before version 7.4.
These were addressed by updating OpenSSH to version 7.4.
CVE-2016-10009
CVE-2016-10010
CVE-2016-10011
CVE-2016-10012

OpenSSL
Available for: macOS Sierra 10.12.3
Impact: A local user may be able to leak sensitive user information
Description: A timing side channel issue was addressed by using
constant time computation.
CVE-2016-7056: Cesar Pereida García and Billy Brumley (Tampere
University of Technology)

Printing
Available for: macOS Sierra 10.12.3
Impact: Clicking a malicious IPP(S) link may lead to arbitrary code
execution
Description: An uncontrolled format string issue was addressed
through improved input validation.
CVE-2017-2403: beist of GrayHash

python
Available for: macOS Sierra 10.12.3
Impact: Processing maliciously crafted zip archives with Python may
lead to arbitrary code execution
Description: A memory corruption issue existed in the handling of zip
archives. This issue was addressed through improved input validation.
CVE-2016-5636

QuickTime
Available for: macOS Sierra 10.12.3
Impact: Viewing a maliciously crafted media file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in QuickTime. This
issue was addressed through improved memory handling.
CVE-2017-2413: Simon Huang(@HuangShaomang) and pjf of IceSword Lab of
Qihoo 360

Security
Available for: macOS Sierra 10.12.3
Impact: Validating empty signatures with SecKeyRawVerify() may
unexpectedly succeed
Description: An validation issue existed with cryptographic API
calls. This issue was addressed through improved parameter
validation.
CVE-2017-2423: an anonymous researcher

Security
Available for: macOS Sierra 10.12.3
Impact: An attacker with a privileged network position may capture or
modify data in sessions protected by SSL/TLS
Description: Under certain circumstances, Secure Transport failed to
validate the authenticity of OTR packets. This issue was addressed by
restoring missing validation steps.
CVE-2017-2448: Alex Radocea of Longterm Security, Inc.

Security
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code with
root privileges
Description: A buffer overflow was addressed through improved bounds
checking.
CVE-2017-2451: Alex Radocea of Longterm Security, Inc.

Security
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted x509 certificate may lead to
arbitrary code execution
Description: A memory corruption issue existed in the parsing of
certificates. This issue was addressed through improved input
validation.
CVE-2017-2485: Aleksandar Nikolic of Cisco Talos

SecurityFoundation
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted certificate may lead to
arbitrary code execution
Description: A double free issue was addressed through improved
memory management.
CVE-2017-2425: kimyok of Tencent Security Platform Department

sudo
Available for: macOS Sierra 10.12.3
Impact: A user in an group named “admin” on a network directory
server may be able to unexpectedly escalate privileges using sudo
Description: An access issue existed in sudo. This issue was
addressed through improved permissions checking.
CVE-2017-2381

System Integrity Protection
Available for: macOS Sierra 10.12.3
Impact: A malicious application may be able to modify protected
disk locations
Description: A validation issue existed in the handling of
system installation. This issue was addressed through improved
handling and validation during the installation process.
CVE-2017-6974: Patrick Wardle of Synack

tcpdump
Available for: macOS Sierra 10.12.3
Impact: An attacker in a privileged network position may be able to
execute arbitrary code with user assistance
Description: Multiple issues existed in tcpdump before 4.9.0. These
were addressed by updating tcpdump to version 4.9.0.
CVE-2016-7922
CVE-2016-7923
CVE-2016-7924
CVE-2016-7925
CVE-2016-7926
CVE-2016-7927
CVE-2016-7928
CVE-2016-7929
CVE-2016-7930
CVE-2016-7931
CVE-2016-7932
CVE-2016-7933
CVE-2016-7934
CVE-2016-7935
CVE-2016-7936
CVE-2016-7937
CVE-2016-7938
CVE-2016-7939
CVE-2016-7940
CVE-2016-7973
CVE-2016-7974
CVE-2016-7975
CVE-2016-7983
CVE-2016-7984
CVE-2016-7985
CVE-2016-7986
CVE-2016-7992
CVE-2016-7993
CVE-2016-8574
CVE-2016-8575
CVE-2017-5202
CVE-2017-5203
CVE-2017-5204
CVE-2017-5205
CVE-2017-5341
CVE-2017-5342
CVE-2017-5482
CVE-2017-5483
CVE-2017-5484
CVE-2017-5485
CVE-2017-5486

tiffutil
Available for: macOS Sierra 10.12.3
Impact: Processing a maliciously crafted image may lead to unexpected
application termination
Description: An out-of-bound read existed in LibTIFF versions before
4.0.7. This was addressed by updating LibTIFF in AKCmds to version
4.0.7.
CVE-2016-3619
CVE-2016-9533
CVE-2016-9535
CVE-2016-9536
CVE-2016-9537
CVE-2016-9538
CVE-2016-9539
CVE-2016-9540

WebKit
Available for: macOS Sierra 10.12.3
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed
through improved state management.
CVE-2017-2486: redrain of light4freedom

WebKit
Available for: macOS Sierra 10.12.3
Impact: An application may be able to execute arbitrary code
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2392: Max Bazaliy of Lookout

WebKit
Available for: macOS Sierra 10.12.3
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed through
improved memory handling.
CVE-2017-2457: lokihardt of Google Project Zero

Installation note:

macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and
Security Update 2017-001 Yosemite may be obtained from the
Mac App Store or Apple’s Software Downloads web site:
https://www.apple.com/support/downloads/

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple’s Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
—–BEGIN PGP SIGNATURE—–
Comment: GPGTools – http://gpgtools.org

iQIcBAEBCgAGBQJY2Yo6AAoJEIOj74w0bLRGPqYQAMBBWvVEfXg753E0gorEMXMG
3OKqGKmkpIgKRSmtNja4Heq/tY2pSBN0CDHKfeGnO6ayUmeH5yZwg8ZWtqaV3bpl
Gx7jBvglsrGt4vSPcUvhQV/4YSrRDMDwqBOqBcrIFRQnUMluybw0PiRkMuUQ1m30
Uh10OO94SJbzqtbGkEHXJX/ajOX5ELlkXE7tHD8Z91IJa95fxN4dZ2mTEiGQ4XCu
NfkDN/U6S+qj+KRl3ra7fIA5QttTQoqM497Efan8soyq9oLrc5jypDrtuKEiU2/x
DUpRxONjOIlmilsYFosMjT+z5PUWdHcfkw6U5sLYcwCgY3hkYwJnJUX6I2VSLjk7
aa85lAGyj/cyqd2n4PEF58bFlGZkfv1BuUp06f8ccEMjG4dxYjCxrVw4uwGvE61n
hVgS25GGhJXbvHxkpggdC6n3Pbe7FqhUPwzhFRhBeFKVw+ed5wf6PoxqiJ+wmu+Y
vEk+b+s1rsPz5WDXc7vkDegA5S3CsxLGEzTDRxvlcktmku08Rv3EHr+1SSAwB5CE
BtOWoT2i6KN4+XgaOdT1dBX2nkeIumM44OS+aJEW27uXSaLD7zm44EjEd1LyQRko
hpruHLPZsZQudpkfayUo6YYu5uNZdfJoNktKhU255keYnrLZk9I8UgXjW0IC5Ev1
CN+j/BMQsIWdeO1Cm3Rc
=DFqi
—–END PGP SIGNATURE—–

_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (Security-announce@lists.apple.com)