Benjamin Beurdouche

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11 **Description** The issue is related to the TLS Handshake Protocol implementation in Secure Transport, which accepts a Certificate Request message within a session where no Server Key Exchange message has been sent. This allows remote attackers to have an unspecified impact via crafted TLS data. The vulnerability is also described as being related to errors in the key exchange procedure, which can be exploited by a remote attacker to compromise information security. **Recommendations** For Apple OS X versions prior to 10.11, update to version 10.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of TLS connections to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11 **Description** The issue is related to the X.509 certificate-trust implementation, which does not properly handle revocation checking. This makes it easier for attackers to conduct man-in-the-middle attacks by using a revoked certificate. The vulnerability can be exploited by a remote attacker to spoof endpoints. **Recommendations** For Apple OS X versions prior to 10.11, update to version 10.11 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources to minimize the risk of exploitation.

🚨 CVE-2015-1637 Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1067. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 8.1.3 Apple TV versions prior to 7.0.3 **Description** The issue concerns the mach port kobject interface in the kernel, which does not properly restrict certain information. This makes it easier for attackers to bypass a security protection mechanism. **Recommendations** For Apple iOS versions prior to 8.1.3, update to version 8.1.3 or later. For Apple TV versions prior to 7.0.3, update to version 7.0.3 or later.