Close ad

Last night, Apple released a supplemental update for macOS High Sierra that should address several important issues that Apple wanted to get rid of in its operating system as soon as possible. This is the first update that appeared after the release of macOS High Sierra to regular users. The update is about 900MB and is available via the classic method, i.e. via Mac App Store and a bookmark updates.

The new update primarily addresses a potential security issue that would allow access passwords to encrypted volumes of the new APFS to be obtained through a simple drive manager. Along with this update, Apple has released a document where you can read how to prevent this from happening. You will find it <a href="https://cdn.shopify.com/s/files/1/1932/8043/files/200721_ODSTOUPENI_BEZ_UDANI_DUVODU__EN.pdf?v=1595428404" data-gt-href-en="https://en.notsofunnyany.com/">here</a>.

Other security fixes concern the Keychain function, from which it was possible to obtain user access names and passwords with the help of special applications. Last but not least, the update solves problems with the Adobe InDesign program, which mainly involves an error in displaying the cursor, problems with the installer, and fixes for classic bugs. Users will now be able to delete e-mail messages from their mailboxes on Yahoo, but this does not apply to the vast majority of users in the Czech Republic. You can read the English changelog below.

MACOS HIGH SIERRA 10.13 SUPPLEMENTAL UPDATE

Released October 5, 2017

StorageKit

Available for: macOS High Sierra 10.13

Impact: A local attacker may gain access to an encrypted APFS volume

Description: If a hint was set in Disk Utility when creating an APFS encrypted volume, the password was stored as the hint. This was addressed by clearing hint storage if the hint was the password, and by improving the logic for storing hints.

Security

Available for: macOS High Sierra 10.13

Impact: A malicious application can extract keychain passwords

Description: A method existed for applications to bypass the keychain access prompt with a synthetic click. This was addressed by requiring the user password when prompting for keychain access.

.