Three critical vulnerabilities in OS X web browser now plugged
Apple has solved three critical bugs affecting its Safari browser for OSX Mountain Lion, Mavericks and Yosemite.
In its latest browser update, Apple's closed security loopholes that
allowed cyber criminals to steal user data and carry out remote code
( Android Lollipop 5.0 vs iOS 8: Which is best? )
The patches in Safari 8.0.6, 6.2.6 and 7.1.6 for Yosemite, Mavericks
and Mountain Lion respectively, all deal with vulnerabilities in WebKit,
the open source software that powers both Safari and Google Chrome.
The first patch deals with three memory corruption issues (CVE-2015-1152, CVE-2015-1153 and CVE-2015-1154) that all allowed arbitrary code execution or unexpected application termination if a user visited a malicious website.
The second patch targets a vulnerability specifically located in
WebKit History that could allow malicious actors to access contents on
the filesystem through an unspecified state management issue (CVE-2015-1155).
Once again, the bug would be exploited when users visited compromised
or specially crafted website targeted towards that vulnerability, but
this time could lead to user information being compromised.
The third and final patch addresses what appears to be a phishing vulnerability (CVE-2015-1156).
On its support page
announcing the updates, Apple said the bug could be exploited by a user
clicking a link that led to a malicious website, which could lead to
Full details of the nature of the vulnerabilities have not yet been
made available. However, as the bug fixes have just been released it is
likely this information will be made available through CVE databases in
the coming week or so.