Description
The Security component in Apple OS X before 10.10.2 does not properly process cached information about app certificates, which allows attackers to bypass the Gatekeeper protection mechanism by leveraging access to a revoked Developer ID certificate for signing a crafted app.
References
- 1031650 vdb-entry
- http://support.apple.com/HT204244
- APPLE-SA-2015-01-27-4 vendor-advisory
- macosx-cve20148838-sec-bypass(100525) vdb-entry