Alfredo Pironti

**Name of the Vulnerable Software and Affected Versions** pass versions 1.7.3 and earlier **Description** The issue allows an attacker to potentially use a password for an unintended resource. For exploitation to occur, a user must perform a git pull, decrypt a password, and log into a remote service with the password. If an attacker controls the central Git server or one of the other members' machines and also controls one of the services already in the password store, they can rename one of the password files in the Git repository to something else. This is possible because pass does not correctly verify that the content of a file matches the filename, so a user might be tricked into decrypting the wrong password and sending that to a service that the attacker controls. **Recommendations** For pass version 1.7.3 and earlier, consider signing commits as a solution to mitigate the risk of exploitation. This can help ensure the integrity of the Git repository and prevent attackers from renaming password files. Additionally, users should be cautious when decrypting passwords and logging into remote services to minimize the risk of sending incorrect passwords to services controlled by attackers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11 **Description** The issue is related to the TLS Handshake Protocol implementation in Secure Transport, which accepts a Certificate Request message within a session where no Server Key Exchange message has been sent. This allows remote attackers to have an unspecified impact via crafted TLS data. The vulnerability is also described as being related to errors in the key exchange procedure, which can be exploited by a remote attacker to compromise information security. **Recommendations** For Apple OS X versions prior to 10.11, update to version 10.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of TLS connections to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple OS X versions prior to 10.11 **Description** The issue is related to the X.509 certificate-trust implementation, which does not properly handle revocation checking. This makes it easier for attackers to conduct man-in-the-middle attacks by using a revoked certificate. The vulnerability can be exploited by a remote attacker to spoof endpoints. **Recommendations** For Apple OS X versions prior to 10.11, update to version 10.11 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources to minimize the risk of exploitation.

🚨 CVE-2015-1637 Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1067. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 8.1.3 Apple TV versions prior to 7.0.3 **Description** The issue concerns the mach port kobject interface in the kernel, which does not properly restrict certain information. This makes it easier for attackers to bypass a security protection mechanism. **Recommendations** For Apple iOS versions prior to 8.1.3, update to version 8.1.3 or later. For Apple TV versions prior to 7.0.3, update to version 7.0.3 or later.