iOS 8.2 Now Available for Download; Brings Apple Watch Support and More

The iOS 8.2 update is now available for download for the iPhone 4S and later models, the iPad 2 and later models, the fifth-generation iPod touch, and the third-generation Apple TV (v7.1 firmware). Developers can now also download Xcode 6.2 from the Mac App Store.

iOS 8.2 brings Apple Watch support to iPhone 5 and newer phones, with a new iPhone app called Apple Watch that will let users pair and sync their Watch with an iPhone. The companion app also allows users to customise watch settings, browse, and download compatible apps from the App Store.

The iOS 8.2 update also brings a new Activity app to view fitness data and achievements from Apple Watch - it appears when the Apple Watch is paired. The Health app has also been improved with the update, and gives users the ability to select the unit of measurements, apart from being able to add and visualise workout sessions from third-party apps.

Other Health app changes include stability improvements when dealing with large amounts of data, and several bug fixes. It also adds a privacy setting that enables turning off tracking of steps, distance and flights climbed.

Also notably, iOS 8.2 brings several overall stability enhancements, from Mail, to Music, Flyover in Maps, VoiceOver reliability, and improved connectivity for Made for iPhone Hearing Aids.

Finally, Apple's iOS 8.2 update also provides security fixes, with one for the FREAK SSL security flaw as promised last week, and a flaw that allowed attackers to restart the iPhone via a malicious SMS.

The full list of changes included in iOS 8.2 is as follows:

This release introduces support for Apple Watch, and also includes improvements to the Health app, increased stability and bug fixes.

Apple Watch support

• New Apple Watch app to pair and sync with iPhone, and to customize watch settings
• New Activity app for viewing fitness data and achievements from Apple Watch; appears when Apple Watch is paired
• Available on iPhone 5 and later

Health app improvements

• Adds the ability to select the unit of measurement for distance, body temperature, height, weight and blood glucose
• Improves stability when dealing with large amounts of data
• Includes the ability to add and visualize workout sessions from 3rd-party apps
• Addresses an issue that may have prevented users from adding a photo in Medical ID
• Fixes units for vitamins and minerals
• Fixes an issue where Health data wouldn't refresh after changing data source order
• Fixes an issue where some graphs showed no data values
• Adds a privacy setting that enables turning off tracking of steps, distance and flights climbed

Stability enhancements

• Increases stability of Mail
• Improves stability of Flyover in Maps
• Improves stability of Music
• Improves VoiceOver reliability
• Improves connectivity with Made for iPhone Hearing Aids

Bug fixes

• Fixes an issue in Maps that prevented navigating to some favorite locations
• Addresses an issue where the last word in a quick reply message wasn't autocorrected
• Fixes an issue where duplicate iTunes purchased content could prevent iCloud restore from completing
• Resolves an issue where some music or playlists didn't sync from iTunes to the Music app
• Fixes an issue where deleted audiobooks sometimes remained on device
• Resolves an issue that could prevent call audio from routing to car speakers while using Siri Eyes Free
• Fixes a Bluetooth calling issue where no audio is heard until the call is answered
• Fixes a timezone issue where Calendar events appear in GMT
• Addresses an issue that caused certain events in a custom recurring meeting to drop from an Exchange calendar
• Fixes a certificate error that prevented configuring an Exchange account behind a third-party gateway
• Fixes an issue that could cause an organizer's Exchange meeting notes to be overwritten
• Resolves an issue that prevented some Calendar events from automatically showing as 'Busy' after accepting an invite

Security updates

iCloud Keychain

Available for: OS X Yosemite v10.10.2

Impact: An attacker with a privileged network position may be able to execute arbitrary code

Description: Multiple buffer overflows existed in the handling of data during iCloud Keychain recovery. These issues were addressed through improved bounds checking.

CVE-ID

CVE-2015-1065 : Andrey Belenko of NowSecure

IOAcceleratorFamily

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10.2

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: An off by one issue existed in IOAcceleratorFamily. This issue was addressed through improved bounds checking.

CVE-ID

CVE-2015-1066 : Ian Beer of Google Project Zero

IOSurface

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10.2

Impact: A malicious application may be able to execute arbitrary code with system privileges

Description: A type confusion issue existed in IOSurface's handling of serialized objects. The issue was addressed through additional type checking.

CVE-ID

CVE-2015-1061 : Ian Beer of Google Project Zero

Kernel

Available for: OS X Yosemite v10.10.2

Impact: Maliciously crafted or compromised applications may be able to determine addresses in the kernel

Description: The mach_port_kobject kernel interface leaked kernel addresses and heap permutation value, which may aid in bypassing address space layout randomization protection. This was addressed by disabling the mach_port_kobject interface in production configurations.

CVE-ID

CVE-2014-4496 : TaiG Jailbreak Team

Secure Transport

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10.2

Impact: An attacker with a privileged network position may intercept SSL/TLS connections

Description: Secure Transport accepted short ephemeral RSA keys, usually used only in export-strength RSA cipher suites, on connections using full-strength RSA cipher suites. This issue, also known as FREAK, only affected connections to servers which support export-strength RSA cipher suites, and was addressed by removing support for ephemeral RSA keys.

CVE-ID

CVE-2015-1067 : Benjamin Beurdouche, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Alfredo Pironti, and Jean Karim Zinzindohoue of Prosecco at Inria Paris