A bug affecting WindowServer could allow an attacker to execute malicious code outside the sandbox.
A bug affecting WindowServer could allow an attacker to execute malicious code outside the sandbox.

Apple has released a security update for Mac users running its Mountain Lion, Mavericks and Lion Server operating systems.

On Tuesday, the update addressed 13 OS X vulnerabilities in total, including numerous bugs that could allow arbitrary code execution.

Of note, a patch for OS X Mountain Lion v10.8.5 and OS X Mavericks 10.9.2 remediated a bug (CVE-2014-1314) which could allow malicious applications to execute arbitrary code outside of the sandbox security mechanism, Apple said.

By exploiting the bug, “WindowServer sessions could be created by sandboxed applications,” the Apple security update said. “This issue was address by disallowing sandboxed applications from creating WindowServer sessions.”

In addition, the update addressed other code execution issues (CVE-2013-5170 and CVE-2014-1319) affecting Mountain Lion v10.8.5 and Mavericks 10.9.2, which could be exploited simply by opening a malicious PDF file or viewing a malicious JPEG image.

Apple also advised users to employ a patch for a vulnerability (CVE-2014-1295) in the operating systems, which could allow an attacker with a “privileged network position” to obtain data or modify operations carried out in SSL-protected sessions.

“In a ‘triple handshake' attack, it was possible for an attacker to establish two connections which had the same encryption keys and handshake, insert the attacker's data in one connection, and renegotiate so that the connections may be forwarded to each other,” the update advisory said of the bug. “To prevent attacks based on this scenario, Secure Transport was changed so that, by default, a renegotiation must present the same server certificate as was presented in the original connection.”