About the security content of macOS Sierra 10.12.1, Security Update 2016-002 El Capitan, and Security Update 2016-006 Yosemite

This document describes the security content of macOS Sierra 10.12.1, Security Update 2016-002 El Capitan, and Security Update 2016-006 Yosemite.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.

Apple security documents reference vulnerabilities by CVE-ID when possible.

macOS Sierra 10.12.1, Security Update 2016-002 El Capitan, and Security Update 2016-006 Yosemite

AppleGraphicsControl

Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11.6

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed through improved lock state checking.

CVE-2016-4662: Apple

AppleMobileFileIntegrity

Available for: macOS Sierra 10.12

Impact: A signed executable may substitute code with the same team ID

Description: A validation issue existed in the handling of code signatures. This issue was addressed through additional validation.

CVE-2016-7584: Mark Mentovai and Boris Vidolov of Google Inc.

AppleSMC

Available for: macOS Sierra 10.12

Impact: A local user may be able to elevate privileges

Description: A null pointer dereference was addressed through improved locking.

CVE-2016-4678: daybreaker@Minionz working with Trend Micro's Zero Day Initiative

ATS

Available for: macOS Sierra 10.12

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: A memory corruption issue was addressed through improved memory handling.

CVE-2016-4667: Simon Huang of alipay, Thelongestusernameofall@gmail.com, Moony Li of TrendMicro, @Flyic

ATS

Available for: macOS Sierra 10.12

Impact: A local user may be able to execute arbitrary code with additional privileges

Description: A memory corruption issue was addressed through improved memory handling.

CVE-2016-4674: Shrek_wzw of Qihoo 360 Nirvan Team

CFNetwork Proxies

Available for: macOS Sierra 10.12

Impact: An attacker in a privileged network position may be able to leak sensitive user information

Description: A phishing issue existed in the handling of proxy credentials. This issue was addressed by removing unsolicited proxy password authentication prompts.

CVE-2016-7579: Jerry Decime

Core Image

Available for: OS X El Capitan v10.11.6

Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution

Description: A memory corruption issue was addressed through improved input validation.

CVE-2016-4681: Ke Liu of Tencent's Xuanwu Lab

CoreGraphics

Available for: macOS Sierra 10.12

Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution

Description: A memory corruption issue was addressed through improved memory handling.

CVE-2016-4673: Marco Grassi (@marcograss) of KeenLab (@keen_lab), Tencent

FaceTime

Available for: macOS Sierra 10.12

Impact: An attacker in a privileged network position may be able to cause a relayed call to continue transmitting audio while appearing as if the call terminated

Description: User interface inconsistencies existed in the handling of relayed calls. These issues were addressed through improved protocol logic.

CVE-2016-7577: Martin Vigo (@martin_vigo) of salesforce.com

FontParser

Available for: macOS Sierra 10.12

Impact: Parsing a maliciously crafted font may disclose sensitive user information

Description: An out-of-bounds read was addressed through improved bounds checking.

CVE-2016-4660: Ke Liu of Tencent's Xuanwu Lab

FontParser

Available for: macOS Sierra 10.12

Impact: Processing a maliciously crafted font file may lead to arbitrary code execution

Description: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking.

CVE-2016-4688: Simon Huang of Alipay company, thelongestusernameofall@gmail.com

IDS - Connectivity

Available for: macOS Sierra 10.12

Impact: An attacker in a privileged network position may be able to trick a user on a multi-party call into believing they are talking to the other party

Description: An impersonation issue existed in the handling of call switching. This issue was addressed through improved handling of "switch caller" notifications.

CVE-2016-4721: Martin Vigo (@martin_vigo) of salesforce.com

ImageIO

Available for: OS X El Capitan v10.11.6

Impact: Parsing a maliciously crafted PDF may lead to arbitrary code execution

Description: An out-of-bounds write was addressed through improved bounds checking.

CVE-2016-4671: Ke Liu of Tencent's Xuanwu Lab, Juwei Lin (@fuzzerDOTcn)

ImageIO

Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11.6

Impact: Processing a maliciously crafted image may result in the disclosure of process memory

Description: An out-of-bounds read issue existed in the SGI image parsing. This issue was addressed through improved bounds checking.

CVE-2016-4682: Ke Liu of Tencent's Xuanwu Lab

ImageIO

Available for: OS X El Capitan v10.11.6

Impact: A remote attacker may be able to execute arbitrary code

Description: Multiple out-of-bounds read and write issues exited in SGI parsing. These issues was addressed through improved input validation.

CVE-2016-4683: Ke Liu of Tencent’s Xuanwu Lab

Kernel

Available for: OS X Yosemite 10.10.5, OS X El Capitan 10.11.6, and macOS Sierra 10.12

Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel

Description: Multiple input validation issues existed in MIG generated code. These issues were addressed through improved validation.

CVE-2016-4669: Ian Beer of Google Project Zero

Kernel

Available for: macOS Sierra 10.12

Impact: A local application may be able to execute arbitrary code with root privileges

Description: Multiple object lifetime issues existed when spawning new processes. These were addressed through improved validation.

CVE-2016-7613: Ian Beer of Google Project Zero

libarchive

Available for: macOS Sierra 10.12

Impact: A malicious archive may be able to overwrite arbitrary files

Description: An issue existed within the path validation logic for symlinks. This issue was addressed through improved path sanitization.

CVE-2016-4679: Omer Medan of enSilo Ltd

libxpc

Available for: macOS Sierra 10.12

Impact: An application may be able to execute arbitrary code with root privileges

Description: A logic issue was addressed through additional restrictions.

CVE-2016-4675: Ian Beer of Google Project Zero

ntfs

Available for: macOS Sierra 10.12

Impact: An application may be able to cause a denial of service

Description: An issue existed in the parsing of disk images. This issue was addressed through improved validation.

CVE-2016-4661: Recurity Labs on behalf of BSI (German Federal Office for Information Security)

NVIDIA Graphics Drivers

Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11.6

Impact: An application may be able to cause a denial of service

Description: A memory corruption issue was addressed through improved input validation.

CVE-2016-4663: Apple

Security

Available for: macOS Sierra 10.12

Impact: A local attacker can observe the length of a login password when a user logs in

Description: A logging issue existed in the handling of passwords. This issue was addressed by removing password length logging.

CVE-2016-4670: Daniel Jalkut of Red Sweater Software

Thunderbolt

Available for: macOS Sierra 10.12

Impact: An application may be able to execute arbitrary code with kernel privileges

Description: A null pointer dereference was addressed through improved input validation.

CVE-2016-4780: sweetchip of Grayhash