Apple Updates OS X and iOS to Patch Security Flaws

Apple is out with its first security update for its OS X El Capitan 10.11 desktop and iOS 9 mobile operating systems. The OS X 10.11.1 and iOS 9.1 security updates debut barely a month after the initial releases of OS X 10.11 and iOS 9.

The security fixes in the new updates benefit from the efforts of researchers working at multiple vendors, including Yahoo and Google, that responsibly disclosed vulnerabilities to Apple.

Apple credits security researcher John Villamil of the Yahoo Pentest team with reporting 13 different Common Vulnerabilities and Exposures (CVEs). Among the issues reported by Villamil are three CVEs in coretext (CVE-2015-6992, CVE-2015-6975 and CVE-2015-7017) that impact both OS X 10.11.1 and iOS 9.1. Additionally, there is one coretext issue (CVE-2015-5944) that is specific to OS X.

“Multiple memory corruption issues existed in the handling of font files,” Apple warns in its advisory. “These issues were addressed through improved bounds checking.”

Yahoo’s Villamil is also credited with reporting nine vulnerabilities (CVE-2015-6976, CVE-2015-6977, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010 and CVE-2015-7018) in the Apple FontParser library that is shared across iOS and OS X.

“Processing a maliciously crafted font file may lead to arbitrary code execution,” Apple warns about the FontParser vulnerabilities in OS X and iOS.

Apple also credits Google’s Project Zero security research effort for reporting four different vulnerabilities. CVE-2015-6995 is a memory corruption issue in Apple’s Disk Images technology that impacts both OS X and iOS. Another memory corruption issue, CVE-2015-6996, also impacts the two operating systems, though it’s a flaw in Apple’s IOAcceleratorFamily image processing technology.

Google Project Zero also reported two flaws that are unique to OS X, including CVE-2015-7003, which is a flaw in Apple’s coreaudiod audio technology that could enable an attacker to execute arbitrary code. CVE-2015-7019, meanwhile, is a vulnerability in Nvidia graphics drivers that Apple includes in OS X.

On iOS 9 in particular, Apple is benefiting from a pair of vulnerability disclosures made by security researchers from PanguTeam. Pangu is well-known for its jailbreak tools that enable iOS users to circumvent Apple’s controls for application installation.

CVE-2015-6979 is a flaw in IOS 9’s GasGuage battery monitoring tool that could enable an attacker to execute arbitrary code with kernel privileges.

The other flaw that PanguTeam is also credited with reporting is CVE-2015-7015—a buffer overflow issue in Domain Name System (DNS).

“A malicious application with the ability to spoof responses from the local configd service may have been able to cause arbitrary code execution in DNS clients,” Apple warns in its advisory.

Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.