xmir

Mac users need to be aware of a security issue with the Sparkle open source updater that is used by many Mac applications for providing updates to newer versions. 

The issue can used for a main-in-the-middle attack when downloading and installing new updates. 

Of the commonly used applications using Sparkle are Teamviewer and the VLC Media Player

Along with a flawed Sparkle version, vulnerable apps must also be running an unencrypted HTTP channel to receive software updates from offsite servers. Nefarious users capable of capturing network traffic, perhaps over an unsecured Wi-Fi connection, can leverage the Sparkle exploit to run malicious code remotely on a target computer. The publication cited work from a software engineer called Radek, who confirmed the exploit affects apps running on the latest versions of OS X 10.11 El Capitan and OS X 10.10 Yosemite.

A list has been made on Github where individuals identify applications that are found to be vulnerable. You may want to check the list and look for an update if you use one of the identified applications and versions.