Η Apple διέθεσε το iOS 7.1.1

[voltmod]

Η Apple αθόρυβα διέθεσε την νέα έκδοση iOS 7.1.1. Πρόκειται για μία μικρή σε μέγεθος αναβάθμιση που στοχεύει κυρίως σε διορθώσεις σε bugs ενώ επιπλέον στην περίπτωση του iPhone 5s, βελτιώνει τη λειτουργία αναγνώρισης δαχτυλικού αποτυπώματος όσο αφορά στο χαρακτηριστικό Touch ID.Επιδιορθώθηκε ένα σφάλμα το οποίο μπορούσε να επηρρεάσει την αποκρισιμότητα του πληκτρολόγιου ενώ διορθώνεται και ένα bug, που αφορούσε στη χρήση πληκτρολογίων Bluetooth με ενεργοποιημένο το VoiceOver.

 

Το iPhone 7.1.1 είναι διαθέσιμο για iPhone 4/4S, iPhone 5/5c/5s, iPad 2, iPad 3ης, 4ης γενιάς και iPad Air, iPad mini και mini με οθόνη Retina καθώς και για iPod 5ης γενιάς. Η αναβάθμιση έχει μέγεθος 26MB περίπου.

 

 

 

Επεξ/σία 23 Απριλίου 2014 από voltmod

[papajohnnnn]

Ωραια!!!Οταν βγει jailbreak για 7.1.1 θα το βαλω.Προς το παρων μενω σε 7.0.6 με jailbreak!!!

[Gi0]

Ωραια!!!Οταν βγει jailbreak για 7.1.1 θα το βαλω.Προς το παρων μενω σε 7.0.6 με jailbreak!!!

Προς το παρον μην τρεφεις ιδιαιτερες ελπιδες για jb. Για την ακριβεια, πιθανον, λιγοτερες και απο το jailbreak για την 7.1.

Το κακο (απο την προοπτικη του jailbreak προφανως) ειναι πως τα συγκεκριμενα security fixes διορθωνουν προβληματα (remote code execution, ASLR+sandbox bypass) τα οποια ηταν λουκουμι για τη δημιουργια νεου jailbreak για την 7.1.

 

 

APPLE-SA-2014-04-22-1 Security Update 2014-002

 

Security Update 2014-002 is now available and addresses the

following:

 

CFNetwork HTTPProtocol

Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,

OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact: An attacker in a privileged network position can obtain web

site credentials

Description: Set-Cookie HTTP headers would be processed even if the

connection closed before the header line was complete. An attacker

could strip security settings from the cookie by forcing the

connection to close before the security settings were sent, and then

obtain the value of the unprotected cookie. This issue was addressed

by ignoring incomplete HTTP header lines.

CVE-ID

CVE-2014-1296 : Antoine Delignat-Lavaud of Prosecco at Inria Paris

 

CoreServicesUIAgent

Available for: OS X Mavericks v10.9.2

Impact: Visiting a maliciously crafted website or URL may result in

an unexpected application termination or arbitrary code execution

Description: A format string issue existed in the handling of URLs.

This issue was addressed through additional validation of URLs. This

issue does not affect systems prior to OS X Mavericks.

CVE-ID

CVE-2014-1315 : Lukasz Pilorz of runic.pl, Erik Kooistra

 

FontParser

Available for: OS X Mountain Lion v10.8.5

Impact: Opening a maliciously crafted PDF file may result in an

unexpected application termination or arbitrary code execution

Description: A buffer underflow existed in the handling of fonts in

PDF files. This issue was addressed through additional bounds

checking. This issue does not affect OS X Mavericks systems.

CVE-ID

CVE-2013-5170 : Will Dormann of CERT/CC

 

Heimdal Kerberos

Available for: OS X Mavericks v10.9.2

Impact: A remote attacker may be able to cause a denial of service

Description: A reachable abort existed in the handling of ASN.1

data. This issue was addressed through additional validation of ASN.1

data.

CVE-ID

CVE-2014-1316 : Joonas Kuorilehto of Codenomicon

 

ImageIO

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact: Viewing a maliciously crafted JPEG image may lead to an

unexpected application termination or arbitrary code execution

Description: A buffer overflow issue existed in ImageIO's handling

of JPEG images. This issue was addressed through improved bounds

checking. This issue does not affect systems prior to OS X Mavericks.

CVE-ID

CVE-2014-1319 : Cristian Draghici of Modulo Consulting, Karl Smith of

NCC Group

 

Intel Graphics Driver

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact: A malicious application can take control of the system

Description: A validation issue existed in the handling of a pointer

from userspace. This issue was addressed through additional

validation of pointers.

CVE-ID

CVE-2014-1318 : Ian Beer of Google Project Zero working with HP's

Zero Day Initiative

 

IOKit Kernel

Available for: OS X Mavericks v10.9.2

Impact: A local user can read kernel pointers, which can be used to

bypass kernel address space layout randomization

Description: A set of kernel pointers stored in an IOKit object

could be retrieved from userland. This issue was addressed through

removing the pointers from the object.

CVE-ID

CVE-2014-1320 : Ian Beer of Google Project Zero working with HP's

Zero Day Initiative

 

Kernel

Available for: OS X Mavericks v10.9.2

Impact: A local user can read a kernel pointer, which can be used to

bypass kernel address space layout randomization

Description: A kernel pointer stored in a XNU object could be

retrieved from userland. This issue was addressed through removing

the pointer from the object.

CVE-ID

CVE-2014-1322 : Ian Beer of Google Project Zero

 

Power Management

Available for: OS X Mavericks v10.9.2

Impact: The screen might not lock

Description: If a key was pressed or the trackpad touched just after

the lid was closed, the system might have tried to wake up while

going to sleep, which would have caused the screen to be unlocked.

This issue was addressed by ignoring keypresses while going to sleep.

This issue does not affect systems prior to OS X Mavericks.

CVE-ID

CVE-2014-1321 : Paul Kleeberg of Stratis Health Bloomington MN,

Julian Sincu at the Baden-Wuerttemberg Cooperative State University

(DHBW Stuttgart), Gerben Wierda of R&A, Daniel Luz

 

Ruby

Available for: OS X Mavericks v10.9.2

Impact: Running a Ruby script that handles untrusted YAML tags may

lead to an unexpected application termination or arbitrary code

execution

Description: An integer overflow issue existed in LibYAML's handling

of YAML tags. This issue was addressed through additional validation

of YAML tags. This issue does not affect systems prior to OS X

Mavericks.

CVE-ID

CVE-2013-6393

 

Ruby

Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,

OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact: Running a Ruby script that uses untrusted input to create a

Float object may lead to an unexpected application termination or

arbitrary code execution

Description: A heap-based buffer overflow issue existed in Ruby when

converting a string to a floating point value. This issue was

addressed through additional validation of floating point values.

CVE-ID

CVE-2013-4164

 

Security - Secure Transport

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact: An attacker with a privileged network position may capture

data or change the operations performed in sessions protected by SSL

Description: In a 'triple handshake' attack, it was possible for an

attacker to establish two connections which had the same encryption

keys and handshake, insert the attacker's data in one connection, and

renegotiate so that the connections may be forwarded to each other.

To prevent attacks based on this scenario, Secure Transport was

changed so that, by default, a renegotiation must present the same

server certificate as was presented in the original connection. This

issue does not affect Mac OS X 10.7 systems and earlier.

CVE-ID

CVE-2014-1295 : Antoine Delignat-Lavaud, Karthikeyan Bhargavan and

Alfredo Pironti of Prosecco at Inria Paris

 

WindowServer

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact: Maliciously crafted applications can execute arbitrary code

outside the sandbox

Description: WindowServer sessions could be created by sandboxed

applications. This issue was addressed by disallowing sandboxed

applications from creating WindowServer sessions.

CVE-ID

CVE-2014-1314 : KeenTeam working with HP's Zero Day Initiative

 

Για να χουμε προοπτικη, τα προβληματα που διορθωνει ειναι αρκετα σοβαροτερα απο το προσφατο Heartbleed ή το gotofail πριν λιγο καιρο. Παρεπιμπτοντως, οι εχοντες mac ανανεωστε το OSX οσο το δυνατον γρηγοροτερα, για τους ιδιους λογους.

[agiohorion]

θελεις φορτιση !!! 

[coffeex]

Πέρα από το update του iOS κυκλοφόρησε και update για το Mac OS X όπως είπε και ο Gi0 παραπάνω.

[voltmod]

Πέρα από το update του iOS κυκλοφόρησε και update για το Mac OS X όπως είπε και ο Gi0 παραπάνω.

Έφτασεεεε....

[Gi0]

Έφτασεεεε....

Η public beta δεν ειναι το security update του OSX

[21century]

Να δούμε αν βελτιώνει την ταχύτητα...

[Gi0]

Να δούμε αν βελτιώνει την ταχύτητα...

Καμια σχεση δεν εχει το update με τη "βελτιωση της ταχυτητας", αλλα φανταζομαι πως δεν ειναι κακο να ελπιζεις.

[sacram73gr]

Και πάλι η μπαταρία βουτάει στον πάτο άμα την κανεις ΟΤΑ αντε πάλι στην επιστροφή η αναβάθμιση ξανα μανα απο τον υπολογιστή

 

Sent from my iPhone using Insomnia

[Thresh]

Καμια σχεση δεν εχει το update με τη "βελτιωση της ταχυτητας", αλλα φανταζομαι πως δεν ειναι κακο να ελπιζεις.

δεν πιστεύω να ελπίζεις ότι θα διαβάσει το post σου το bot μπας και σταματήσει τα cliche posts?

[Gi0]

δεν πιστεύω να ελπίζεις ότι θα διαβάσει το post σου το bot μπας και σταματήσει τα cliche posts?

Nah, προφανως και οχι. Να ξεκαθαρισω την κατασταση θελω, για οποιον καλοπιστο διαβαζει το post