Oct 17, 2015 You can install legacy versions of Java in OS X El Capitan by using the Java for OS X 2015-001 installer, which includes Java 6. To be clear, Java 6 is a version from 2013, it is outdated and no longer supported by Oracle, it has various known security holes, and is therefore inappropriate for most Mac users to install without a compelling reason. Jan 13, 2016 El Capitan is only partially compatible with Adobe CS5. Once you install the legacy version of Java (6) CS5 apps will work with differing degrees of success. Illustrator CS5 is a particular problem. It doesn't save preferences like units (mm or pixels etc), the eyedropper tool will crash the program when sampling colour is gradients or raster. Even after upgrading to the latest version of Java, while running some applications on macOS Sierra (10.12), El Capitan (OS X 10.11), or Yosemite (OS X 10.10), users see a dialog box prompting to download Java.
About Apple security updates
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.
For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.
Apple security documents reference vulnerabilities by CVE-ID when possible.
Safari 11.1.2
Released July 9, 2018
Safari
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2018-4279: Ruilin Yang, Xu Taoyu (xia0yu.win)
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Entry updated October 30, 2018
WebKit
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2018-4270: found by OSS-Fuzz
WebKit
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: A malicious website may exfiltrate audio data cross-origin
Description: Sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.
CVE-2018-4278: Jun Kokatsu (@shhnjk)
WebKit
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A type confusion issue was addressed with improved memory handling.
CVE-2018-4284: found by OSS-Fuzz
Entry updated October 30, 2018
WebKit
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: A malicious website may be able to cause a denial of service
Description: A race condition was addressed with additional validation.
CVE-2018-4266: found by OSS-Fuzz
WebKit
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
CVE-2018-4261: Omair working with Trend Micro's Zero Day Initiative
CVE-2018-4262: Mateusz Krzywicki working with Trend Micro's Zero Day Initiative
CVE-2018-4263: Arayz working with Trend Micro's Zero Day Initiative
CVE-2018-4264: found by OSS-Fuzz, Yu Zhou and Jundong Xie of Ant-financial Light-Year Security Lab
CVE-2018-4265: cc working with Trend Micro's Zero Day Initiative
CVE-2018-4267: Arayz of Pangu team working with Trend Micro's Zero Day Initiative
CVE-2018-4272: found by OSS-Fuzz
WebKit
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash
Description: Multiple memory corruption issues were addressed with improved input validation.
CVE-2018-4271: found by OSS-Fuzz
CVE-2018-4273: found by OSS-Fuzz
WebKit
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: Visiting a malicious website may lead to address bar spoofing
Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.
CVE-2018-4274: Tomasz Bojarski
Java For El Capitan 2 Wallpapers
Entry updated October 30, 2018
WebKit Page Loading
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6
Impact: Visiting a malicious website may lead to address bar spoofing
El Capitan State Beach
Description: An inconsistent user interface issue was addressed with improved state management.
Update From El Capitan
CVE-2018-4260: xisigr of Tencent's Xuanwu Lab (tencent.com)