Users are urged to update their Macs as soon as possible

Mar 31, 2018 18:43 GMT  ·  By
Security Update 2018-002 Sierra and Security Update 2018-002 El Capitan released
   Security Update 2018-002 Sierra and Security Update 2018-002 El Capitan released

After releasing the macOS High Sierra 10.13.4 software update on March 30, 2018, Apple released new security updates for macOS Sierra 10.12 and macOS El Capitan 10.11 users to address three dozens of security vulnerabilities.

The Security Update 2018-002 Sierra and Security Update 2018-002 El Capitan are now available for macOS Sierra 10.12 and macOS El Capitan 10.11 users to patch a total of 34 security vulnerabilities discovered and reported by various researchers across several components of Apple's macOS operating system.

According to the support document published by Apple on March 31, 2018, the two security updates address an injection issue that could suddenly truncate the password of an APFS formatted volume, as well as an issue that would allow other local users to read the passwords supplied to sysadminctl.

"The sysadminctl command-line tool required that passwords be passed to it in its arguments, potentially exposing the passwords to other local users. This update makes the password parameter optional, and sysadminctl will prompt for the password if needed," reads the security advisory.

The updates also address two security flaws in the Mail app, including an issue in the handling of S/MIME HTML e-mails, which could allow a privileged attacker to exfiltrate the contents of S/MIME-encrypted e-mail, and a UI issue that could let a privileged attacker to intercept the contents of S/MIME-encrypted e-mail.

Kernel and Nvidia and Intel graphics drivers improvements

The kernel receives several security improvements in both macOS Sierra and El Capitan as Apple addressed a total of five vulnerabilities that could allow maliciously crafted apps to execute arbitrary code with kernel or system privileges, as well as to read the restricted memory.

The Nvidia and Intel graphics drivers have been updated as well to address memory corruption and validation issues that could allow a maliciously crafted app to read the restricted memory or execute arbitrary code with system privileges. A similar memory corruption issue was fixed in the IOFireWireFamily component too.

A race condition in the iCloud Drive could allow an application to gain elevated privileges, so Apple fixed that as well in these new security updates for macOS El Capitan, Sierra, and High Sierra, which resolve the issue that could allow a mounted malicious disk image to launch a specific app.

On top of that, Apple fixed a PDFKit issue that could redirect users to a malicious website when clicking a URL in a specially crafted PDF, a. command injection issue in the Terminal app that could lead to arbitrary command execution spoofing if malicious content was pasted, and a System Preferences bug that kept a configuration profile in effect after its been removed.

Various other security vulnerabilities, most of them allowing maliciously crafted apps to gain elevated privileges, were fixed in the ATS, CFNetwork Session, CoreFoundation, CoreText, CoreTypes, cURL, LaunchServices, NSURLSession, PDFKit, PluginKit, Quick Look, and WindowServer components, so updating your Macs as soon as possible is highly recommended.