Editing the Custom Dictionary on Apple Mac Computers

If you’ve ever mistakenly added a word to you custom dictionary using right click and Learn Spelling for a misspelled or unknown word, you will want to correct this in your custom dictionary.

Follow these steps to update your custom dictionary.

  1. Open your user Library folder. To do this, hold down the Option key and then from the Go menu in the Finder choose Library.
  2. Open the Spelling folder.
  3. Open the Text Edit program found in your Applications.
  4. Click and drag the LocalDictionary file (found in the Spelling folder) to the Text Edit icon in your Dock. This will open the file in the editor.
  5. From the File menu, choose Duplicate to create a backup copy of the file. Give it a name like LocalDictionary Backup.
  6. Make the desired changes to the main file (not the backup file).
  7. If you’re on a newer Mac, the LocalDictionary file will update automatically.

Apple Tip: Video Settings to Save Power and Increase Performance

20160401fr0954-special-thanks-to-makur-310x150The default video settings for Apple computers are intended to result in an elegant visual presentation.

Transparency and a range of smooth grayscale graphics are designed to enhance the user experience.

However, these features use more power and can slow down your computer.

To change the contrast and transparency settings, go to System Preferences and choose Accessibility. Then enable Reduce Transparency and Increase Contrast.

  • Transparency. The transparency feature uses significant video processing power. This can slow down the computer and use more power.
  • Contrast. When you increased contrast, needed icons and critical visual elements stand out more. This makes it possible to reduce your display brightness slightly without losing visual clarity.

Instructions

See the steps below to make the adjustments.

STEP #1 – System Preferences

20160401fr0942-apple-mac-osx-choose-system-preferences

STEP #2 – Accessibility

20160401fr0944-apple-mac-osx-system-preferences-window

STEP #3 – Reduce Transparency & Increase Contrast

20160401fr0858-apple-mac-osx-video-settings-power-performance-transparency-contrast

Apple iPad Pro Email Signature Duplication Problem

There’s presently an issue that seems to only be happening on the Apple iPad Pro where email signature is duplicated at the bottom of emails when changing the From sending address.

Here’s how to reproduce the error:

  1. Setup multiple send from addresses following the instructions found here: “Using Multiple Send From Email Addresses in Apple iOS.” Keep in mind that this has only been tested for people who have generic IMAP or POP3 email services (like those provided by a website hosting company).
  2. Create a new email message or reply to an existing message.
  3. For the From address, choose an account, and then choose another account. Each time you choose a new account, the signature won’t be replaced (as is normally the case), but instead an additional signature will be placed at the bottom of your message.
  4. If you switch to another app, and return to your in-progress draft email, another email signature will be added again each time you switch away and come back.

If a solution is found, it will be posted here.

Apple iCloud Sync Problems with Contacts and Calendar

You may occasionally experience synchronization issues with Apple iCloud, specifically with contacts or calendar entries.

Most of the time, when you add a contact or calendar event on your desktop or laptop computer, it will immediately and magically show up on all your other devices. However, sometimes it may be several minutes later and it doesn’t show up.

This can be a problem if you leave your home or office, thinking the recently added contacts will now be on your mobile device, but they aren’t.

This problem goes both ways. Sometimes items added to mobile devices don’t show up on their OS X equivalent apps.

So, here’s a trick that just might work:

  • On OS X, you can exit the Calendar or Contacts apps and start them again. This can help force a synchronization with iCloud.
  • On mobile devices, closing and re-opening apps may or may not work. You may need to add a new contact or event for the synchronization to be initiated.

Push technology is supposed to ensure that data synchronization and flow is forced to happen in real-time. However, it sometimes doesn’t work, so these tips can help in such situations.

These problems, and the solutions mentioned above, can actually happen on any synchronization platform (Windows, Android, Chrome OS, Linux, etc.) so it’s not necessarily an issue isolated to Apple.

For Google devices, a check-in can be established by sending an email or checking for new messages. This will initiate communications with their cloud services.

Using Apple iCloud Email and Alias Addresses

The following is from Apple’s support website as of 22 Feb 2016. It’s being reproduced here for archival purposes, easy reference, centralized searching, and also to be disseminated through our social media and network of followers.


 

Create or change email aliases

An email alias is an email address that conceals your actual email address from a recipient. You could create an alias to use when buying items from online stores, signing up for mailing lists, and registering online, and reserve your real email address for use with family and friends. In this way, aliases can help you better manage the email you receive and monitor the sources of unwanted messages.

You can also send email using an alias.

You can have up to three active email aliases, and you can delete or turn off an email alias at any time. You might want to turn off an alias if, for example, you use an alias to make a purchase. After you receive the item, you can turn off the alias to avoid follow-up advertisements, then turn it on again when you make another purchase.

Deleting an alias is permanent, so if you think you might want to use the alias again, you should simply turn it off. When an alias is turned off, all email sent to that alias is returned to the sender.

Note: If you had five MobileMe email address aliases when you moved your account to iCloud, you retain the five aliases. However, once you delete one of your five aliases, you can’t create a new one to replace it.

Aliases are not transferable. Only the iCloud account that created the alias can use it as an email address.

You can’t use an alias to sign in to iCloud.com, and you can’t use an alias to create a separate iCloud account.

Create an email alias

  1. In iCloud Mail, click the Action pop-up menu in the sidebar, then choose Preferences.
  2. Click Accounts.
  3. Click “Add an alias.”
  4. Provide the requested information:
    • Alias: The text you provide becomes the email address (alias@icloud.com). An alias must contain between 3 and 20 characters.
    • Full Name: The name you provide appears in the From field of the recipient’s email.
    • Label: iCloud Mail uses the label to categorize messages sent to your account.
    • Label Color: Messages appear in your Inbox with the colored label that you specify.
  5. Click OK, then click Done.

Change, turn off, turn on, or delete an alias

  1. In iCloud Mail, click the Action pop-up menu in the sidebar, then choose Preferences.
  2. Click Accounts.
  3. Select the alias in the Addresses list, then do any of the following:
    • To choose a new color for incoming messages, click a Label Color option. Alias labels appear only in the iCloud Mail app on iCloud.com.
    • To change the name or label, enter a new alias name and label in the fields provided. Alias names must contain between 3 and 20 characters.
    • To turn off an alias, select “Disable alias.”

      When an alias is turned off, all email messages addressed to that alias are returned to the sender.

    • To turn on an alias, deselect “Disable alias.”
    • To delete an alias, click Delete.
  4. Click Done.

Select addresses you can send from

  1. In iCloud Mail, click the Action pop-up menu in the sidebar, then choose Preferences.
  2. Click Composing.
  3. Click the “Set a default address” pop-up menu, then choose the address you usually use.
  4. In the list of addresses, select the ones you want to be able to send from while using iCloud Mail.

    The selected addresses appear in the From pop-up menu when you create a new email message. For instructions, see Send email using an alias.

Set a default address to send from

If you created aliases or you have an @me.com or @mac.com address in addition to your @icloud.com address, you can choose one to use as the default address when sending mail from your iCloud account.

  • In iCloud Mail, follow the instructions in “Select addresses you can send from,” above.
  • On your iOS 8 device, go to Settings > Mail, Contacts, Calendars > iCloud. In the Advanced section, tap Mail, tap Email, then tap the address you usually want to send from.
  • On your iOS 7 device, go to Settings > Mail, Contacts, Calendars > iCloud > Account. Tap Mail, tap Email, then tap the address you usually want to send from.
  • On your Mac, open Mail, then choose Mail > Preferences. In the Composing pane, click the “Send new messages from” pop-up menu, then choose the address you usually want to send from.
  • On your Windows computer, do one of the following:
    • In Outlook 2010, 2013, or 2016, choose File > Info > Account Settings > Account Settings, click the Email tab, select the address you usually want to send from, then click “Set as default.”
    • In Outlook 2007, choose Tools > Account Settings, click the Email tab, select the address you usually want to send from, then click “Set as default.”

How to Adjust Brightness on Secondary Apple Mac Display

If you have an Apple Mac computer with a second Apple display attached, you can adjust the brightness using the following keyboard key combination on an Apple keyboard:

Hold the control key while pressing the brightness up or down keys (F1 / F2)

This only works with Apple displays and may not work on all Apple computers. This is typically an issue for people with MacBook laptop computers since the common configuration is to use the built-in display and also an external Apple display.

20160118mo0801-adjust-brightness-on-secondary-apple-mac-cinema-27-inch-display

Here’s Why You Need to Buy the Fastest Computer Possible

Causes of Computer Slowness

I hear from a lot of people who are experiencing slowness on their Apple or Windows computers. Slowness can be caused by a variety of factors, as explained in the article “Eight reasons why your computer is slow.”

  • Insufficient Memory. What seemed like enough memory when you first purchased your computer is no longer enough.
  • Memory Management. Computers that don’t properly manage memory, and release available memory when a program is exited, may become slow because your computer that came with 8GB or 16GB of RAM is reduced to running on 2GB or less. This pushes currently used files and program data onto the much slower hard drive.
  • Old Drive Technology. Those using computers with older internal hard drives that aren’t solid state drive (SSD) technology will experience slower operation.
  • Hard Drive Failure. Computers with failing hard drives will start to run slower. This typically happens when mechanical hard drives begin to have mechanical failures. This kind of mechanical breakdown isn’t an issue with solid state hard drive (SSD) technology.
  • Defective Programs. With Apple or Windows, there are sometimes periods of months or longer where some program, task, or process may be causing problems. For example, if you do a Google search on “apple mail slow” as you type those words you’ll see that the third most popular thing people are searching on is “apple mail slowing down computer.” That problem has been around for a while. For someone with a slower computer, it will become almost unusable. However, for someone who purchased the faster computer, you can still get work done.
  • Anti-Virus Software. The complex anti-virus software that’s required today is increasingly spreading its tentacles into every area of our computers and even our local networks to ensure there are no viruses or hackers. This slows down computers.
  • Using Too Many Programs. These days, people tend to have more programs open simultaneously, drawing from multiple files and websites to complete a task, and sometimes being easily distracted into starting multiple unrelated tasks at one time — call it multitasking or ADHD, the results are the same.
  • The Internet is More Complex. In the past, reading content on the web involved loading pages full of text. Now, browsers are like independent operating systems that run mini programs. Google Chrome for example can run programs and apps that you purchase from their app store just for the browser. Java and Flash are typically used to run processor intensive tasks.

The options are either to speed up the existing computer by addressing each of the above issues separately, or purchase a new computer.

With Windows computers, typically purchasing as much as  you can afford is the best choice. For the money, desktops usually have more powerful processors than laptop computers. So, they are a good choice for people who don’t have a lot of money to spend.

Purchasing a Fast Apple MacBook Pro

I’ve noticed with Apple computers these days, the faster models are really required to get ‘snappy’ and responsive performance. The iMac computers are a good value, but for those who need portability the new MacBook Pro computers are a good choice. http://www.apple.com/macbook-pro/

I’d recommend the 13-inch (13.3″) for anyone who wants something smaller for portability, or the 15-inch (15.4″) if that size would still be easy enough to carry around. That is, of course, personal preference.

It’s important to note that the 15-inch MacBook Pro is capable of a much faster and more powerful configurations.

The 15-inch screen is really much bigger and better to work with for anyone spending a lot of time on the computer. The 15-inch computer is about 1 pound heavier.

Some people want a very thin light laptop they can carry every day. Those people are typically willing to have a smaller screen for portability.

If you’re going to get the 13-inch model, I’d suggest the one with 512GB storage (SSD – solid state hard drive) that’s $1,799 on this page:

http://www.apple.com/shop/buy-mac/macbook-pro

Or, for the 15-inch, you’d want the $2,499 model (further down) on that page.

The 13-inch model has options to upgrade to a faster Core i7 processor ($200) and 16GB of RAM ($200) which brings their price to $2,200. You’d want these upgrades.

The 15-inch model (at $2,499) already comes with 16GB RAM and 512GB of storage. However, unlike the 13-inch model, the 15-inch model can be upgraded to a quad-core Intel Core i7 processor for $200 more. This makes a huge difference in terms of processing power and longevity of the computer. The price would be $2,699 for the 15-inch model upgraded.

Because Apple computers are typically more expensive than Windows computers, the small marginal increase in price to get the more powerful Apple models ends up being an economical choice because the faster models may last a year or two longer — and will be much faster during the entire time of ownership.

Apple Computer Slow with AccountSD High CPU Usage and Fans Spinning Fast

You may notice that your Apple MacBook or iMac computer is running slow, the fans are spinning very fast, and the Activity Monitor (found inside of Applications > Utilities) indicates very high CPU usage for the accountsd process. If you have a multi-core processor the percentage of CPU usage may exceed 100% because more than one full CPU is dedicated to serving that task.

The accountsd process seems to have something to do with the System Preferences > Internet Accounts functions including the real-time continuous notification system. This is why it may seem that some runaway task has monopolized your computer’s CPU and is causing it to slow down.

According to some Apple Discussion threads about this issue, Google accounts may be causing problems. However, our tests show that the CPU usage remained high even after deleting all Google accounts. Other accounts that could cause high CPU usage would be Facebook or Twitter since they are always monitoring for recent updates to notify you about.

Removing unnecessary accounts can help get the CPU usage down to about 30-40% which will result in the fans not running so fast.

Here’s Why Apple Makes the Best Windows Computer

Apple computers have the ability to run Windows, Linux, and Apple operating systems. Here are some reasons why purchasing an Apple laptop or desktop computer is a good decision for Windows users.

  1. Design. Apple computers are known for their beautiful design. This makes them pleasant to interact with.
  2. Displays. Apple has always had nice computer displays and the latest computers include Retina display technology in their laptop and high-end desktop computers. With ambient light sensors and keyboard controlled brightness, you can personalize the display making it very easy on your eyes.
  3. Keyboard. The Apple wireless or wired keyboards are excellent for those working long hours on the computer. The keys have short travel, and entry errors are almost non existent. Apple keyboards feature short-travel keys, which means your fingers don’t need to push the keys down as far, and you can type faster with less effort.
  4. Multiple Operating Systems. Using a product like VMWare Fusion, you can run multiple operating systems on an Apple computer. You can have Apple, Windows, and Linux. If you’re a computer and technical support professional, you’ll likely need to support Apple and Windows computers. With virtual computing, you could have Windows 7, Windows 8, and Windows 10 running at the same time.
  5. Portability. The newer MacBook computers are thiner and lighter than previous models. The new MacBook, MacBook Air, and MacBook Pro computers are very thin and light.
  6. Security. Although Apple computers aren’t entirely impervious to viruses, they are much more secure than Windows computers.
  7. Space Savings. Apple iMac computers are slim and accommodate an aluminum wireless keyboard that takes up very little desk space.
  8. Touch Pad. For those concerned about repetitive stress injuries, the Apple touchpad is essential. It’s highly accurate, easy to use, and with multiple gestures that require a very light touch.
  9. Voice Dictation. Apple uses the same Siri voice recognition technology in their desktop/laptop operating system as with the iPhone. It’s quite accurate in a quiet environment.

20150225we-apple-computer-renewable-energy-santa-monica

Multiple Security Vulnerabilities in Apple Mac OS X and Apple Safari

From: State of Iowa – Information Security Office

Date Issued:  May 5, 2015

Maximum Risk Rating/Severity:  High

Brief Summary: All Apple computers (prior to v10.10.3) are vulnerable to the 46 security exploits described below. Update to the latest version of Yosemite immediately.

Overview:

Multiple vulnerabilities have been discovered in Apple MAC OS X and Apple Safari. Mac OS X is an operating system for Apple computers. Apple Safari is a web browser available for Mac OS X and Microsoft Windows. These vulnerabilities can be exploited if a user visits or is redirected to a specially crafted webpage, or opens a specially crafted file, including an email attachment, using a vulnerable version of OS X.

Successful exploitation could result in an attacker gaining the same privileges as the logged on user, remote code execution within the context of the application, and bypass of security systems. Failed attacks may cause a Denial of Service condition within the targeted delivery method. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. 

Affected Software:

Apple Mac OS X Yosemite prior to v10.10.3

Apple Mac OS X Mavericks v10.9.5

Apple Mac OS X Mountain Lion v10.8.5

Apple Safari v8.0.5, 7.1.5, and 6.2.5

Description:

Multiple remote code execution vulnerabilities have been discovered in Mac OS X that could allow remote code execution. These vulnerabilities can be exploited if a user visits or is redirected to a specially crafted webpage or opens a specially crafted file. Details of these vulnerabilities are as follows:

  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to privilege escalation due to an issue with checking XPC entitlements (CVE-2015-1130).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 have multiple vulnerabilities in Apache prior to versions 2.4.10 and 2.2.29 including one that may allow a remote attacker to execute arbitrary code (CVEs 2015-1066, 2013-5704, 2013-6438, 2014-0098, 2014-0117, 2014-0118, 2014-0226, and 2014-0231).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion 10.8.5, and OS X Mavericks v10.9.5 ATS (Apple Type Services) are prone to multiple input validation issues in fontd which may allow a local user to execute arbitrary code with system privileges (CVEs 2015-1131, 2015-1132, 2015-1133, 2015-1134, and 2015-1135).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to a cross-domain cookie issue which may result in cookies belonging to one origin may be sent to another origin (CVE-2015-1089).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to a cross-domain HTTP request issue which may result in authentication credentials being sent to a server on another origin (CVE-2015-1091).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to an input validation issue which may result in the execution of arbitrary code by visiting a maliciously crafted website (CVE-2015-1088).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a use-after-free issue in CoreAnimation which may result in the execution of arbitrary code by visiting a maliciously crafted website (CVE-2015-1136).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to multiple memory corruption issues in the processing of font files, which may result in the execution of arbitrary code by processing a maliciously crafted font file (CVE-2015-1093).
  • Apple Mac OS X Yosemite prior to v10.10.2 and OS X Mavericks v10.9.5 are prone to an issue with NVIDIA graphics driver’s handling of certain IOService userclient types, which may allow a local user to execute arbitrary code with system privileges (CVE-20215-1137).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to an input validation issue in the hypervisor framework which may allow a local application to cause a denial of service (CVE-2015-1138).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a memory corruption issue in the handling of .sgi files which may result in the execution of arbitrary code by processing a maliciously crafted .sgi file (CVE-2015-1139).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to a memory corruption issue which may allow a malicious HID (Human Interface Device) to cause arbitrary code execution (CVE-2015-1095).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a buffer overflow issue which may allow a local user to execute arbitrary code with system privileges (CVE-2015-1140).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prune to a kernel memory content disclosure issue which may allow a local user to determine kernel memory layout (CVE-2015-1096).
  • Apple Mac OS X Mountain Lion v10.8.5 and OS X Mavericks v10.9.5 are prone to a heap buffer overflow in the IOHIDFamily’s handling of key-mapping properties which may allow a malicious application to execute arbitrary code with system privileges (CVE-2014-4404).
  • Apple Mac OS X Mountain Lion v10.8.5 and OS X Mavericks v10.9.5 are prone to a null pointer deference issue in the IOHIDFamily’s handling of key-mapping properties which may allow a malicious application to execute arbitrary code with system privileges (CVE-2014-4405).
  • Apple Mac OS X Mountain Lion v10.8.5 and OS X Mavericks v10.9.5 are prone to an out-of-bounds issue in the IOHIDFamily driver which may allow a use to execute arbitrary code with system privileges (CVE-2014-4380).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to an issue in the handling of virtual memory operations within the kernel which may allow a local user to cause unexpected system shutdown (CVE-2015-1141).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a race condition in the kernel’s setreuid system call which may allow a local user to cause a system denial of service (CVE-2015-1099).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to setreuid and setregid system calls not dropping privileges permanently which may allow a local application to escalate privileges (CVE-2015-1117).
  • Apple Mac OS X Yosemite prior to v10.10.2 ICMP redirects were enabled by default, which may allow an attacker with a privileged network position to redirect user traffic to arbitrary hosts (CVE-2015-1103).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to an issue processing TCP headers which may allow an attacker with a privileged network position to cause a denial of service (CVE-2015-1102).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to an out of bounds memory access issue which may allow a local user to cause unexpected system termination or read kernel memory (CVE-2015-1100).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to improper treatment of some IPv6 packets which may allow a remote user to bypass network filters (CVE-2015-1104).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a memory corruption issue in the kernel which may allow a local user to execute arbitrary code with kernel privileges (CVE-2015-1101).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to a state inconsistency issue in the handling of TCP out of band data which may allow a remote attacker to cause a denial of service (CVE-2015-1105).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to an input validation issue in LaunchService’s handling of application localization data which may allow a local user to cause the Finder to crash (CVE-2015-1142).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a type confusion in LaunchService’s handling of localized strings which may allow a local user to execute arbitrary code with system privileges (CVE-2015-1143).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to a memory corruption issue in the handling of configuration profiles which may allow the processing of a maliciously crafted configuration profile to cause unepxted application termination (CVE-2015-1118).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to weak key generation in ntpd when an authentication key is not configured which may allow a remote attacker to brute force ntpd authentication keys (CVE-2014-9298).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to multiple input validation issue in OpenLDAP which may allow a remote unauthenticated client to case a denial of service (CVEs 2015-1545 and 2015-1546).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to multiple vulnerabilities in OpenSSL 0.9.8zc, including one that may allow an attacker to intercept connections to a server that supports export-grade ciphers (CVEs 2014-3569, 2014-3570, 2014-3571, 2014-3572, 2014-8275, and 2015-0204).
  • Apple Mac OS X Yosemite prior to v10.10.2 and OSX Mavericks v10.9.5 are prone to an Open Directory Client issue which may allow an unencrypted password to be sent over the network when using Open Directory from OS X Server (CVE-2015-1147).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to multiple vulnerabilities in PHP, including one which may lead to arbitrary code execution (CVEs 2013-6712, 2014-0207, 2014-0237, 2014-0238, 2014-2497, 2014-3478, 2014-3479, 2014-3480, 2014-3487, 2014-3538, 2014-3587, 2014-3597, 2014-3668, 2014-3669, 2014-3670, 2014-3710, 20214-3981, 2014-4049, 2014-4670, 2014-4698, and 2014-5120).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a memory corruption issue in the handling of iWork files which may allow an opened, maliciously crafted iWork file to execute arbitrary code (CVE-2015-1098).
  • Apple Mac OS X Mountain Lion v10.8.5 is prone to a heap buffer overflow which may allow viewing a maliciously crafted Collada file to lead to arbitrary code execution (CVE-2014-8830).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to an issue that may allow a user’s password to be logged to a local file (CVE 2015-1148).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to an issue that may allow tampered applications to launch (CVEs 2015-1145 and 2015-1146).
  • Apple Mac OS X Yosemite prior to v10.10.2 is prone to a memory corruption issue in WebKit that may result in arbitrary code execution after visiting a maliciously crafted website (CVE-2015-1069).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to an issue in Safari that may allow users to be tracked by malicious websites using client certificates (CVE-2015-1129).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to an issue in Safari that may allow user’s browsing history in private browsing mode to be revealed (CVE-2015-1128).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to an issue in Safari that will cause the incomplete purging of a user’s browsing history (CVE-2015-1112).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to multiple memory corruption issues in WebKit that may result in unexpected application termination or arbitrary code execution after visiting a maliciously crafted website (CVEs 2015-1119, 2015-1120, 2015-1121,2015-1122, and 2015-1124).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a state management issue that may result in a user’s browsing history in private mode being indexed (CVE02015-1127).
  • Apple Mac OS X Yosemite prior to v10.10.2, OS X Mountain Lion v10.8.5, and OS X Mavericks v10.9.5 are prone to a an issue in WebKit’s credential handling for FTP URLs that may result in resources of another origin being accessed after visitng a maliciously crafted website (CVE-2015-1126).
  • Security Update 2015-004 (available for OS X Mountain Lion v10.8.5 and OS X Mavericks v10.9.5) also addresses an issue caused by the fix for CVE-2015-1067 in Security Update 2015-002. This issue prevented Remote Apple Events clients on any version from connecting to the Remote Apple Events server. In default configurations, Remote Apple Events is not enabled.

Successful exploitation could result in an attacker gaining the same privileges as the logged on user, remote code execution within the context of the application, and bypass of security systems. Failed attacks may cause a Denial of Service condition within the targeted delivery method. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Solution/Recommendations:

We recommend the following actions be taken:

  • Upgrade to Apple Mac OS X Yosemite 10.10.3 immediately after appropriate testing.
  • Apply appropriate updates provided by Apple to vulnerable systems immediately after appropriate testing.
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Remind users not to download, accept, or execute files from un-trusted or unknown sources.
  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.

Apple References:

20140226we-apple-computer-security-500x500