JPEGs & PDFs can ATTACK any Apple Mac, iPhone, iPad

[Anthea]

It's nearly 2017 and JPEGs, PDFs, font files can hijack your Apple Mac, iPhone, iPad

Apple has distributed a fresh round of security updates to address remote-code execution holes in iOS, macOS, Safari, and the firmware for Apple Watch and AppleTV.

Miscreants who exploit these flaws can take over the vulnerable device – all a victim has to do is open a JPEG or PDF file booby-trapped with malicious code, so get patching before you're caught out. Check for software

The fixes come just days before the Cupertino developer of TextEdit is set to hold a special event to introduce a (presumed) refresh of its Mac product line and potentially new iPad tablets.

For those running iOS, the 10.1 release includes updates to address 12 CVE-listed security vulnerabilities in the firmware for the iPhone, iPad and iPod Touch.

Those flaws include a remote code execution flaw in the handling of JPEG images (CVE-2016-4673), a remote code execution bug in WebKit (CVE-2016-4677), local code execution flaws, and a vulnerability in contacts (CVE-2016-4686) that would let an application pull Address Book details even when access has been revoked.

For macOS Sierra (10.12.1), the update brings fixes for 16 CVE-listed vulnerabilities. Those include the CVE-2016-4673 image-handling bug as well as remote code execution flaws that could be triggered by font files (CVE-2016-4667) and PDF files (CVE-2016-4671). Also released was a fix for a denial of service error in Nvidia graphics card drivers (CVE-2016-4663) and a bug that exposed the length of user passwords (CVE-2016-4670).

Included among the latest fixes for iOS and macOS was CVE-2016-4635, a remote audio eavesdropping vulnerability for FaceTime that Apple had previously attempted to remedy in older versions of iOS and OS X.

Apple did not say whether the flaw was exposed in iOS 10.1 and macOS Sierra, or if the fix was an update to an already-installed security measure.

For those running the Safari browser on Sierra and older versions of OS X, Apple has produced patches to address a trio of WebKit flaws that can allow web pages or applications to achieve remote code execution (CVE-2016-4666, CVE-2016-4677) and pull location information (CVE-2016-4676).

Meanwhile, Apple Watch users are advised to update their arm candy to watchOS 3.1 to get fixes for eight CVE-listed flaws, including two flaws in sandbox profiles (CVE-2016-4664, CVE-2016-4665) that allow third-party applications to view image libraries and sound files without permission.

The AppleTV will also get an update for 10 flaws, including the sandbox profiles flaws (CVE-2016-4664, CVE-2016-4665), the WebKit remote code execution bug (CVE-2016-4677), and the CoreGraphics JPEG bug (CVE-2016-4673) patched in other Apple products. ®

http://www.theregister.co.uk/2016/10/24 ... ty_update/

[Anthea]

My solution is to only use Linux

I have spent the last couple of weeks trying assorted Distributions

Linux Mint is by far the most popular and easy to use

The original Red Hat that came with a collection of massive manuals

Much of Mint is based on the love of Ian and Debbie

As people start to realise the above Debian itself has now overtaken Ubuntu

I also enjoy playing with new unknown distributions

There is even a new SuperTux