Sep 30, 2015 OS X 10.11 El Capitan: The Ars Technica Review. It was 2009 when Apple last released a new operating system on physical media. Things have proceeded remarkably smoothly since version 10.7 switched. Edit 2016: This is true for any OS except El Capitan - Apple are leaving it available so devices ineligible for Sierra can still obtain it. You need to already have it in your Purchase History, otherwise once it's gone from the App Store, that's it, it's gone.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see How to use the Apple Product Security PGP Key.

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other security updates, see Apple security updates.

OS X El Capitan v10.11

Megaseg For El Capitan De

Address Book
Available for: Mac OS X v10.6.8 and later
Impact: A local attacker may be able to inject arbitrary code to processes loading the Address Book framework
Description: An issue existed in Address Book framework's handling of an environment variable. This issue was addressed through improved environment variable handling.
CVE-ID
CVE-2015-5897 : Dan Bastone of Gotham Digital Science

AirScan
Available for: Mac OS X v10.6.8 and later
Impact: An attacker with a privileged network position may be able to extract payload from eSCL packets sent over a secure connection
Description: An issue existed in the processing of eSCL packets. This issue was addressed through improved validation checks.
CVE-ID
CVE-2015-5853 : an anonymous researcher

apache_mod_php
Available for: Mac OS X v10.6.8 and later
Impact: Multiple vulnerabilities in PHP
Description: Multiple vulnerabilities existed in PHP versions prior to 5.5.27, including one which may have led to remote code execution. This issue was addressed by updating PHP to version 5.5.27.
CVE-ID
CVE-2014-9425
CVE-2014-9427
CVE-2014-9652
CVE-2014-9705
CVE-2014-9709
CVE-2015-0231
CVE-2015-0232
CVE-2015-0235
CVE-2015-0273
CVE-2015-1351
CVE-2015-1352
CVE-2015-2301
CVE-2015-2305
CVE-2015-2331
CVE-2015-2348
CVE-2015-2783
CVE-2015-2787
CVE-2015-3329
CVE-2015-3330

Apple Online Store Kit
Available for: Mac OS X v10.6.8 and later
Impact: A malicious application may gain access to a user's keychain items
Description: An issue existed in validation of access control lists for iCloud keychain items. This issue was addressed through improved access control list checks.
CVE-ID
CVE-2015-5836 : XiaoFeng Wang of Indiana University, Luyi Xing of Indiana University, Tongxin Li of Peking University, Tongxin Li of Peking University, Xiaolong Bai of Tsinghua University

AppleEvents
Available for: Mac OS X v10.6.8 and later
Impact: A user connected through screen sharing can send Apple Events to a local user's session
Description: An issue existed with Apple Event filtering that allowed some users to send events to other users. This was addressed by improved Apple Event handling.
CVE-ID
CVE-2015-5849 : Jack Lawrence (@_jackhl)

Audio
Available for: Mac OS X v10.6.8 and later
Impact: Playing a malicious audio file may lead to an unexpected application termination
Description: A memory corruption issue existed in the handling of audio files. This issue issue was addressed through improved memory handling.
CVE-ID
CVE-2015-5862 : YoungJin Yoon of Information Security Lab. (Adv.: Prof. Taekyoung Kwon), Yonsei University, Seoul, Korea

bash
Available for: Mac OS X v10.6.8 and later
Impact: Multiple vulnerabilities in bash
Description: Multiple vulnerabilities existed in bash versions prior to 3.2 patch level 57. These issues were addressed by updating bash version 3.2 to patch level 57.
CVE-ID
CVE-2014-6277
CVE-2014-7186
CVE-2014-7187
Certificate Trust Policy
Available for: Mac OS X v10.6.8 and later
Impact: Update to the certificate trust policy
Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/kb/HT202858.

CFNetwork Cookies
Available for: Mac OS X v10.6.8 and later
Impact: An attacker in a privileged network position can track a user's activity
Description: A cross-domain cookie issue existed in the handling of top level domains. The issue was address through improved restrictions of cookie creation.
CVE-ID
CVE-2015-5885 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University

CFNetwork FTPProtocol
Available for: Mac OS X v10.6.8 and later
Impact: Malicious FTP servers may be able to cause the client to perform reconnaissance on other hosts
Description: An issue existed in the handling of FTP packets when using the PASV command. This issue was resolved through improved validation.
CVE-ID
CVE-2015-5912 : Amit Klein

CFNetwork HTTPProtocol
Available for: Mac OS X v10.6.8 and later
Impact: A maliciously crafted URL may be able to bypass HSTS and leak sensitive data
Description: A URL parsing vulnerability existed in HSTS handling. This issue was addressed through improved URL parsing.
CVE-ID
CVE-2015-5858 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University
CFNetwork HTTPProtocol
Available for: Mac OS X v10.6.8 and later
Impact: An attacker with a privileged network position may be able to intercept network traffic
Description: An issue existed in the handling of HSTS preload list entries in Safari private browsing mode. This issue was addressed through improved state handling.
CVE-ID
CVE-2015-5859 : Rosario Giustolisi of University of Luxembourg

CFNetwork HTTPProtocol
Available for: Mac OS X v10.6.8 and later
Impact: A malicious website may be able to track users in Safari private browsing mode
Description: An issue existed in the handling of HSTS state in Safari private browsing mode. This issue was addressed through improved state handling.
CVE-ID
CVE-2015-5860 : Sam Greenhalgh of RadicalResearch Ltd

CFNetwork Proxies
Available for: Mac OS X v10.6.8 and later
Impact: Connecting to a malicious web proxy may set malicious cookies for a website
Description: An issue existed in the handling of proxy connect responses. This issue was addressed by removing the set-cookie header while parsing the connect response.
CVE-ID
CVE-2015-5841 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University

CFNetwork SSL
Available for: Mac OS X v10.6.8 and later
Impact: An attacker with a privileged network position may intercept SSL/TLS connections
Description: A certificate validation issue existed in NSURL when a certificate changed. This issue was addressed through improved certificate validation.
CVE-ID
CVE-2015-5824 : Timothy J. Wood of The Omni Group

CFNetwork SSL
Available for: Mac OS X v10.6.8 and later
Impact: An attacker may be able to decrypt data protected by SSL
Description: There are known attacks on the confidentiality of RC4. An attacker could force the use of RC4, even if the server preferred better ciphers, by blocking TLS 1.0 and higher connections until CFNetwork tried SSL 3.0, which only allows RC4. This issue was addressed by removing the fallback to SSL 3.0.

CoreCrypto
Available for: Mac OS X v10.6.8 and later
Impact: An attacker may be able to determine a private key
Description: By observing many signing or decryption attempts, an attacker may have been able to determine the RSA private key. This issue was addressed using improved encryption algorithms.

CoreTe