Safari 3.2.3 is now available and addresses the following:
libxml
CVE-ID: CVE-2008-3529
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.7, Mac OS X Server v10.5.7, Windows XP or Vista
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A heap buffer overflow exists in libxml's handling of
long entity names. Visiting a maliciously crafted website may lead to
an unexpected application termination or arbitrary code execution.
This update addresses the issue through improved bounds checking.
Safari 3.2.3 is included in the Mac OS X v10.5.7 update. Safari 3.2.3
on Mac OS X requires either Mac OS X v10.5.7, or Mac OS X v10.4.11
with Security Update 2009-002 installed.
Safari
CVE-ID: CVE-2009-0162
Available for: Mac OS X v10.5.7, Mac OS X Server v10.5.7,
Windows XP or Vista
Impact: Accessing a maliciously crafted "feed:" URL may lead to
arbitrary code execution
Description: Multiple input validation issues exist in Safari's
handling of "feed:" URLs. Accessing a maliciously crafted "feed:" URL
may lead to the execution of arbitrary JavaScript. This update
addresses the issues by performing additional validation of "feed:"
URLs. These issues do not affect systems prior to Mac OS X v10.5.
Safari 3.2.3 is included in the Mac OS X v10.5.7 update. Credit to
Billy Rios and Microsoft Vulnerability Research (MSVR), and Alfredo
Melloni for reporting these issues.
WebKit
CVE-ID: CVE-2009-0945
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.7, Mac OS X Server v10.5.7, Windows XP or Vista
Impact: Visiting a maliciously crafted website may lead to arbitrary
code execution
Description: A memory corruption issue exists in WebKit's handling
of SVGList objects. Visiting a maliciously crafted website may lead
to arbitrary code execution. This update addresses the issue through
improved bounds checking. Safari 3.2.3 is included in the Mac OS X
v10.5.7 update. Safari 3.2.3 on Mac OS X requires either Mac OS X
v10.5.7, or Mac OS X v10.4.11 with Security Update 2009-002
installed. Credit to Nils working with TippingPoint's Zero Day
Initiative for reporting this issue.
iQEcBAEBAgAGBQJKCbCgAAoJEHkodeiKZIkBYIYH/RgKY6f0Gc8uRpwY5WiyOkU9
uPIEBJG9z/JHSQAHFUPQkBt+pX5/glxGJynxcOwgGEqX7nUSHIp4TteuxFAExMwo
9u+JXnhVXjiZv7jGKLUE2KhnuweL/doIC74uYjSguViFASFpBTKAqpV/mqzrEPys
IWsm8HYR5DXSw7d1QipkzormuXSmm0hwl8+tNVMLOqIBaq4nDAUIjHeRKCjHTkd1
Xo1/GMtqcFaFexvtbrKe6Ut/etS8NJPLpetMjNxOw5qZDZiP9MV2EviKRQ2TVXG0
9MIe6rxVDfwLQGAF9rTgtfpqiheojzWcxU0OzqDoJFVDWO5KAvdN8CW6yBpnOVA=
=4rJD
-----END PGP SIGNATURE-----
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/security-announce/email@hidden
