APPLE-SA-2015-09-16-1 iOS 9

APPLE-SA-2015-09-16-1 iOS 9

iOS 9 is now available and addresses the following:

Apple Pay
Available for:  iPhone 6, iPad mini 3, and iPad Air 2
Impact:  Some cards may allow a terminal to retrieve limited recent
transaction information when making a payment
Description:  The transaction log functionality was enabled in
certain configurations. This issue was addressed by removing the
transaction log functionality.
CVE-ID
CVE-2015-5916

AppleKeyStore
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  A local attacker may be able to reset failed passcode
attempts with an iOS backup
Description:  An issue existed in resetting failed passcode attempts
with a backup of the iOS device. This was addressed through improved
passcode failure logic.
CVE-ID
CVE-2015-5850 : an anonymous researcher

Application Store
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Clicking a malicious ITMS link may lead to a denial of
service in an enterprise-signed application
Description:  An issue existed with installation through ITMS links.
This was addressed through additional installation verification.
CVE-ID
CVE-2015-5856 : Zhaofeng Chen, Hui Xue, and Tao (Lenx) Wei of
FireEye, Inc.

Audio
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later
Impact:  Playing a malicious audio file may lead to an unexpected
application termination
Description:  A memory corruption issue existed in the handling of
audio files. This issue issue was addressed through improved memory
handling.
CVE-ID
CVE-2015-5862 : YoungJin Yoon of Information Security Lab. (Adv.:
Prof. Taekyoung Kwon), Yonsei University, Seoul, Korea

APPLE-SA-2015-09-16-2 Xcode 7.0

APPLE-SA-2015-09-16-2 Xcode 7.0

Xcode 7.0 is now available and addresses the following:

DevTools
Available for:  OS X Yosemite v10.10.4 or later
Impact:  An attacker may be able to bypass access restrictions
Description:  An API issue existed in the apache configuration. This
issue was addressed by updating header files to use the latest
version.
CVE-ID
CVE-2015-3185 : Branko Aibej of the Apache Software Foundation

IDE Xcode Server
Available for:  OS X Yosemite 10.10 or later
Impact:  An attacker may be able to access restricted parts of the
filesystem
Description:  A comparison issue existed in the node.js send module
prior to version 0.8.4. This issue was addressed by upgrading to
version 0.12.3.
CVE-ID
CVE-2014-6394 : Ilya Kantor

[slackware-security] mozilla-firefox (SSA:2015-265-01)

[slackware-security]  mozilla-firefox (SSA:2015-265-01)

New mozilla-firefox packages are available for Slackware 14.1, and -current to
fix security issues.


Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/mozilla-firefox-38.3.0esr-i486-1_
slack14.1.txz:  Upgraded.
  This release contains security fixes and improvements.
  For more information, see:
    http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-firefox-38.3.0esr-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-firefox-38.3.0esr-x86_64-1_slack14.1.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-firefox-41.0-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-firefox-41.0-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 14.1 package:
84f46bd3e1089e554e585bf71e2ceaae  mozilla-firefox-38.3.0esr-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
a49549a8a3c1100414a85b958f9f978d  mozilla-firefox-38.3.0esr-x86_64-1_slack14.1.txz

Slackware -current package:
d4530e8689701abc336e0dfccff42cf7  xap/mozilla-firefox-41.0-i586-1.txz

Slackware x86_64 -current package:
62233f2d1a42ef9564f80d0fe0b24639  xap/mozilla-firefox-41.0-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg mozilla-firefox-38.3.0esr-i486-1_slack14.1.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+