Apple has announced the latest round of security updates for OS X 10.8, 10.9 and 10.10 (Mountain Lion, Mavericks and Yosemite) which can receive security update 2015-002. iOS has been updated to version 8.2 and Apple TV is being upgraded to version 7.1.
All of the above updates fix the FREAK TLS bug and more.
Recall that FREAK is a security flaw that could allow an attacker to trick you into thinking you are on a secure TLS connection, while actually having compromised security by using insecure, crackable encryption keys.
The flaw, discovered by a team of researchers, including three from Microsoft, was initially thought to only affect OpenSSL connections and Apple 's Secure Transport system library .
But Microsoft quickly realized that its own Schannel TLS library was at risk through Internet Explorer.
All three platforms (Apple TV, iOS, and OS X) are affected by the same Remote Code Execution (RCE) vulnerability, found by Google's Project Zero.
The flaw was discovered in Apple's IOSurface programming framework. IOSurface allows two processes to share the video rendering buffer so that frames can be decompressed by one process but displayed in a separate movie player.
Ironically, as Apple explains, IOSurface “is typically used to allow applications to perform image decompression in separate processes to enhance security.”
See all the details of the update from Apple's announcement page.
