Security-announce

Download

security-announce@lists.apple.com

January 2006

1 participants
2 discussions

APPLE-SA-2006-01-10 QuickTime 7.0.4
by Apple Product Security 10 Jan '06

10 Jan '06

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2006-01-10 QuickTime 7.0.4 QuickTime 7.0.4 is available and delivers the following security enhancements: CVE-ID: CVE-2005-2340 Available for: Mac OS X v10.3.9 and later, Windows XP/2000 Impact: A maliciously-crafted QTIF image may result in arbitrary code execution Description: By carefully crafting a corrupt QTIF image, an attacker can trigger a heap buffer overflow that may result in arbitrary code execution. This update addresses the issue by performing additional validation of GIF images. Credit to Varun Uppal of Kanbay for reporting this issue. CVE-ID: CVE-2005-3707, CVE-2005-3708, CVE-2005-3709 Available for: Mac OS X v10.3.9 and later, Windows XP/2000 Impact: Viewing a maliciously-crafted TGA image may result in arbitrary code execution Description: By carefully crafting a corrupt TGA image, an attacker can trigger a buffer overflow, integer overflow, or integer underflow that may result in a denial-of-service or arbitrary code execution. This update addresses the issue by performing additional validation of TGA images. Credit to Dejun Meng of Fortinet for reporting this issue. CVE-ID: CVE-2005-3710, CVE-2005-3711 Available for: Mac OS X v10.3.9 and later, Windows XP/2000 Impact: Viewing a maliciously-crafted TIFF image may result in arbitrary code execution Description: By carefully crafting a corrupt TIFF image, an attacker can trigger an integer overflow that may result in a denial-of-service or arbitrary code execution. This update addresses the issue by performing additional validation of TIFF images. Credit to Dejun Meng of Fortinet for reporting this issue. CVE-ID: CVE-2005-3713 Available for: Mac OS X v10.3.9 and later, Windows XP/2000 Impact: A maliciously-crafted GIF image may result in arbitrary code execution Description: By carefully crafting a corrupt GIF image, an attacker can trigger a heap buffer overflow that may result in arbitrary code execution. This update addresses the issue by performing additional validation of GIF images. Credit to Karl Lynn of eEye Digital Security for reporting this issue. CVE-ID: CVE-2005-4092 Available for: Mac OS X v10.3.9 and later, Windows XP/2000 Impact: A maliciously-crafted media file may result in arbitrary code execution Description: By carefully crafting a corrupt media file, an attacker can trigger a heap buffer overflow that may result in arbitrary code execution. This update addresses the issue by performing additional validation of media files. Credit to Karl Lynn of eEye Digital Security for reporting this issue. QuickTime 7.0.4 may be obtained from the Software Update pane in System Preferences, or from the Download tab in the QuickTime site http://www.apple.com/quicktime/ For Mac OS X v10.3.9 or later The download file is named: "QuickTimeInstallerX.dmg" Its SHA-1 digest is: a605fc27d85b4c6b59ebbbc84ef553b37aa8fbca For Windows 2000/XP The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 1f7d1942fec2c3c205079916dc47b254e508de4e Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.4 (Build 4042) iQEVAwUBQ8QXBYHaV5ucd/HdAQJxEAgAmYODWY0Bi3uyqkrk7iH3jB3HsmjARyqz YMFag6iFmvkGJ4VAZ943RhbrcBsjk8XQAMtnolRuD4FGSQQHD7a4fzeYdGIRp3qo V2XZBVW1cMAS8x0KzGNKhbRZsZZQw+0AcXbBq8oJU87XtjxVIM7Oo89k03AtkY1M bSqM/IshcNrvbtUDqOsxFEufNN2gwPeGD4Hsqto1qd822AF4Ulpdp45E8kgCiqFA Jm72cj6g1LqXZs8PZZdp6/eD9AazDPDe6N4yC6WhZMXJcfiAaZY6wNSYXsSVceGK W6+0hr4el+bB3PA2o7stKVrK2FwhuYg0A/FiiyhkM6K25jwf8OgZsw== =SKXP -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2006-01-05 AirPort firmware update
by Apple Product Security 05 Jan '06

05 Jan '06

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2006-01-05 AirPort firmware update The following AirPort firmware updates are available: AirPort Express Firmware Update 6.3 for Mac OS X AirPort Express Firmware Update 6.3 for Windows AirPort Extreme Firmware Update 5.7 for Mac OS X AirPort Extreme Firmware Update 5.7 for Windows They each provide a security enhancement for the following issue: CVE-ID: CVE-2005-3714 Impact: AirPort network interface becomes unresponsive Description: A malicious network attacker that can generate specially crafted packets may be able to cause an AirPort base station's network interface to stop responding normally, resulting in a denial-of-service. This update addresses the issue by discarding the malformed packets. Credit to Michael Zanetta of NETwork Security Consortium for reporting this issue. The AirPort updates may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ AirPort Express Firmware Update 6.3 for Mac OS X The download file is named: "AirPortExpressFWUpdater.dmg" Its SHA-1 digest is: 281eaf91612824c3f1dead34c77d61029544f9f7 AirPort Express Firmware Update 6.3 for Windows The download file is named: "AirPortExpressFWUpdater.exe" Its SHA-1 digest is: d8ff8310ef19b5fc4f022091742578ca2cd664d6 AirPort Extreme Firmware Update 5.7 for Mac OS X The download file is named: "AirPortExtremeFWUpdater.dmg" Its SHA-1 digest is: 4378959dd52c2d60bb91568b03f042893d59afca AirPort Extreme Firmware Update 5.7 for Windows The download file is named: "AirPortExtremeFWUpdater.exe" Its SHA-1 digest is: 05b39317a1388b85569e9be1333f85a0019edb39 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.4 (Build 4042) iQEVAwUBQ+JRuYHaV5ucd/HdAQJ1GwgAnaynEHDDDPWYBjOMYaP18kqxkvwIbKRP mL9Y9LU59FjLCeNILP8RHjJ2t7Y56bSd5jyAoMwmIhNhbwqDDr7nAK+hw9MFbI2S JEBf0VFLbcRSdx8GoiWHxq462BIj29g7k9QIXjz1+QHzItpFpQms6dbxDZzaS3Bo 1+Ezwi54T7KGWXFOCtpy7S8U6XyDkhTEvx5L3f+9Y5yUj0tL3la2PE6ccsorJe1Y TkvLHE/bpIYIg6/7kF+5Ki1aKkYkttS/EaNiMrlx+YvVtLvWsleKs2Y8nFMqErHE CQ2F/TJPJ7pUp2C//s1dpQ90PZwV8nw1aMoT1Iw5tCpffGLif9D5JA== =Tp8M -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0