December 2007 - Security-announce

Safari 3 Beta 3.0.4 Security Update v1.1
by Apple Product Security 22 Dec '07

22 Dec '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Safari 3 Beta 3.0.4 Security Update v1.1 Safari 3 Beta 3.0.4 Security Update v1.1 is now available. It addresses an issue introduced in Safari 3 Beta 3.0.4 Security Update that causes an unexpected termination of the Safari application when browsing to certain web sites. There is no change to the security content provided in Safari 3 Beta 3.0.4 Security Update. The security content of Safari 3 Beta 3.0.4 Security Update and Safari 3 Beta 3.0.4 Security Update v1.1 is available via http://docs.info.apple.com/article.html?artnum=307178 Safari 3 Beta 3.0.4 Security Update v1.1 will install over Safari 3 Beta 3.0.4 Security Update, and its installation is recommended to correct the Safari issue. Systems that have not yet installed Safari 3 Beta 3.0.4 Security Update only need to install Safari 3 Beta 3.0.4 Security Update v1.1. Safari 3 Beta 3.0.4 Security Update v1.1 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Windows XP or Vista The download file is named: "Safari304BetaSecUpdateSetup.exe" Its SHA-1 digest is: 44d788791fb060a97cdc9d09d9973919b181cc35 Safari+QuickTime for Windows XP or Vista The file is named: "Safari304BetaSecUpdateQuickTimeSetup.exe" Its SHA-1 digest is: 17ad827789d11bb3c4407a68beb6df942bfa7382 To verify that your version of Safari has been updated: * In Safari, click on "About Safari" under the Safari menu * The version will be "Version 3.0.4 (523.15)" or later This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.3 (Build 2932) iQEVAwUBR2yHjcgAoqu4Rp5tAQiLkggAk4sp2s8G4eNiFjMYFwXVvLQuA6Xle1vX cekEtKw2nRDQIflTyRyEUZVsTVIq5gs3dMOiI6hWax5KovwWGVaxlZX8RkHry0Wz OihGbLYcjaM9dggIdMQG6l0qEyCqYDu7ebcQr2kPCG3Rpx4Tzc8ARqvrj6JNc9T/ BYiquF5G/ybjbstvq9+PPn9nsMbv6uCN8Pw3MbkNaLDZuzbrOBdH5VX2B1iqVuDY D/g4J76FEXkdeCE1OAZKytxuCZYeI6NN8ujh21K/UHtbIwNYpNaQ4qIAaYUiI7VR FkjXb9+TBQe0WUpbB3aqUOV+KFxPLFMl4RQVlPo5eBxED1ZVN74toQ== =vHyb -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

Security Update 2007-009 v1.1
by Apple Product Security 22 Dec '07

22 Dec '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Security Update 2007-009 v1.1 Security Update 2007-009 v1.1 is now available for Mac OS X v10.5.1 and Mac OS X v10.4.11. It addresses an issue introduced in Security Update 2007-009 that causes an unexpected termination of the Safari application when browsing to certain web sites. There is no change to the security content provided in Security Update 2007-009. The security content of Security Update 2007-009 and Security Update 2007-009 v1.1 is available via http://docs.info.apple.com/article.html?artnum=307179 Security Update 2007-009 v1.1 will install over Security Update 2007-009, and its installation is recommended to correct the Safari issue. Systems that have not yet installed Security Update 2007-009 only need to install Security Update 2007-009 v1.1. Security Update 2007-009 v1.1 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.5.1 The download file is named: "SecUpd2007-009.dmg" Its SHA-1 digest is: 0ba35ef30a525792f1d4015395997b42f524dd38 For Mac OS X v10.4.11 (Universal) The download file is named: "SecUpd2007-009Univ.dmg" Its SHA-1 digest is: 49f52d4f647ea4a1fabef34cccac263bfd03791a For Mac OS X v10.4.11 (PPC) The download file is named: "SecUpd2007-009Ti.dmg" Its SHA-1 digest is: d1c5c4bc23267dd846bb96e7be69b084579c1bba Information will also be posted to the Apple Security Updates web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.3 (Build 2932) iQEVAwUBR2yHqcgAoqu4Rp5tAQiGwQf/Xa8F0NLAhcttdbfOhHwSKY1/Lei5EOdf y4iA/7GEloHMHwJNk1TiScQSPYdQ1FIvLaucCrdix1QubNdNj1aOReajz3kkpUKB 9cznYdan24Ic5ZeB82eK2nXMaANyRx5egHkir3BjAkg6kGu4AooBh9YXzUeV0sW0 w+YDb2i+90Hih6OGFg8WOFcaHzvttylQ76Q1inbKrnR9yEoleBGz4tsDn4wH6/dI P/7MqLZnJgJBaQNjGYlR7/nuB1RNS6ZVi766OvZs5p5m1c2/Pr9raEK1DNsaZuZp Ths7PAtalMPqo94ilQgJbCKMak+CumIgkFtkHUfOjNNtnDBtQwNxZg== =sHBj -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-12-17 Safari 3 Beta Update 3.0.4 Security Update
by Apple Product Security 17 Dec '07

17 Dec '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-12-17 Safari 3 Beta Update 3.0.4 Security Update Safari 3 Beta Update 3.0.4 Security Update is now available and addresses the following issue: Safari CVE-ID: CVE-2007-5858 Available for: Windows XP or Vista Impact: Visiting a malicious website may result in the disclosure of sensitive information Description: WebKit allows a page to navigate the subframes of any other page. Visiting a maliciously crafted web page could trigger a cross-site scripting attack, which may lead to the disclosure of sensitive information. This update addresses the issue by implementing a stricter frame navigation policy. This issue is addressed for Mac OS X in Security Update 2007-009. Safari 3 Beta 3.0.4 Security Update is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Windows XP or Vista The download file is named: "Safari304BetaSecUpdateSetup.exe" Its SHA-1 digest is: 4ee67ff207a7cf9fc6a8a08f30d41967b4b2460c Safari+QuickTime for Windows XP or Vista The file is named: "Safari304BetaSecUpdateQuickTimeSetup.exe" Its SHA-1 digest is: 5c293083c0e8e573ed7e200fb0172e1e60bb343e To verify that your version of Safari has been updated: * In Safari, click on "About Safari" under the Safari menu * The version will be "Version 3.0.4 (523.13)" or later This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.0.867 wsBVAwUBR2bhQMgAoqu4Rp5tAQgzlwgAmUt4Heysty/k50J72MD6Cf3Jra2/I9Ic 7RfSvnXyn99NwIJcoKRSBHa3huOUdBSXRdq0JgZkMBgs7TsOvM6PbgjjeG94Yi37 5jRn/YqfGjlOfo4omXuZRQMUj0jopHNL1qc3/98RJ9y11bKUMlXhJL/2p5LFcKF1 DMm8/ZXzMVTwUBS1uDpmcKPubngiKFILZTZhefYWiUanBQoOtaAqUGFuXfUG1u3T df5JLgam1cGV5mfiZyMYlfQnHC4XTy1Vh0jcREIqsFaZlIQ5pKDTGVOOJM5mRd0b V9011ljyYcUPUuhqQoooWbTotdwnymht4drRaR8eMhMQ/eUI+il+Ww== =ZWtQ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-12-17 Security Update 2007-009
by Apple Product Security 17 Dec '07

17 Dec '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-12-17 Security Update 2007-009 Security Update 2007-009 is now available and addresses the following issues: Address Book CVE-ID: CVE-2007-4708 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A format string vulnerability exists in Address Book's URL handler. By enticing a user to visit a maliciously crafted website, a remote attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of format strings. This issue does not affect systems running Mac OS X 10.5 or later. CFNetwork CVE-ID: CVE-2007-4709 Available for: Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Visiting a malicious website could allow the automatic download of files to arbitrary folders to which the user has write permission Description: A path traversal issue exists in CFNetwork's handling of downloaded files. By enticing a user to visit a malicious website, an attacker may cause the automatic download of files to arbitrary folders to which the user has write permission. This update addresses the issue through improved processing of HTTP responses. This issue does not affect systems prior to Mac OS X 10.5. Credit to Sean Harding for reporting this issue. ColorSync CVE-ID: CVE-2007-4710 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Viewing a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in the handling of images with an embedded ColorSync profile. By enticing a user to open a maliciously crafted image, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of images. This issue does not affect systems running Mac OS X 10.5 or later. Credit to Tom Ferris of Adobe Secure Software Engineering Team (ASSET) for reporting this issue. Core Foundation CVE-ID: CVE-2007-5847 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Usage of CFURLWriteDataAndPropertiesToResource API may lead to the disclosure of sensitive information Description: A race condition exists in the CFURLWriteDataAndPropertiesToResource API, which may cause files to be created with insecure permissions. This may lead to the disclosure of sensitive information. This update addresses the issue through improved file handling. This issue does not affect systems running Mac OS X 10.5 or later. CUPS CVE-ID: CVE-2007-5848 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A local admin user may be able to gain system privileges Description: A buffer overflow issue exists in the printer driver for CUPS. This may allow a local admin user to gain system privileges by passing a maliciously crafted URI to the CUPS service. This update addresses the issue by ensuring that the destination buffer is sized to contain the data. This issue does not affect systems running Mac OS X 10.5 or later. Credit to Dave Camp at Critical Path Software for reporting this issue. CUPS CVE-ID: CVE-2007-4351 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in the handling of Internet Printing Protocol (IPP) tags, which may allow a remote attacker to cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. CUPS CVE-ID: CVE-2007-5849 Available for: Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: If SNMP is enabled, a remote attacker may cause an unexpected application termination or arbitrary code execution Description: The CUPS backend SNMP program broadcasts SNMP requests to discover network print servers. A stack buffer overflow may result from an integer underflow in the handling of SNMP responses. If SNMP is enabled, a remote attacker may exploit this issue by sending a maliciously crafted SNMP response, which may cause an application termination or arbitrary code execution. This update addresses the issue by performing additional validation of SNMP responses. This issue does not affect systems prior to Mac OS X 10.5. Credit to Wei Wang of McAfee Avert Labs for reporting this issue. Desktop Services CVE-ID: CVE-2007-5850 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Opening a directory containing a maliciously-crafted .DS_Store file in Finder may lead to arbitrary code execution Description: A heap buffer overflow exists in Desktop Services. By enticing a user to open a directory containing a maliciously crafted .DS_Store file, an attacker may cause arbitrary code execution. This update addresses the issue through improved bounds checking. This issue does not affect systems running Mac OS X 10.5 or later. Flash Player Plug-in CVE-ID: CVE-2007-5476 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Multiple vulnerabilities in Adobe Flash Player Plug-in Description: Adobe Flash Player is updated to version 9.0.115.0 to address CVE-2007-5476. Further information is available via the Adobe site at http://www.adobe.com/support/security/advisories/apsa07-05.html Credit to Opera Software for reporting this issue. GNU Tar CVE-ID: CVE-2007-4131 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Extracting a maliciously crafted tar archive could overwrite arbitrary files Description: A directory traversal issue exists in GNU Tar. By enticing a local user to extract a maliciously crafted tar archive, an attacker may cause arbitrary files to be overwritten. This issue has been addressed by performing additional validation of tar files. This issue does not affect systems running Mac OS X 10.5 or later. iChat CVE-ID: CVE-2007-5851 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A person on the local network may initiate a video connection without the user's approval Description: An attacker on the local network may initiate a video conference with a user without the user's approval. This update addresses the issue by requiring user interaction to initiate a video conference. This issue does not affect systems running Mac OS X 10.5 or later. IO Storage Family CVE-ID: CVE-2007-5853 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Opening a maliciously crafted disk image may lead to an unexpected system shutdown or arbitrary code execution Description: A memory corruption issue exists in the handling of GUID partition maps within a disk image. By enticing a user to open a maliciously crafted disk image, an attacker may cause an enexpected system shutdown or arbitrary code execution. This update addresses the issue through additional validation of GUID partition maps. This issue does not affect systems running Mac OS X 10.5 or later. Launch Services CVE-ID: CVE-2007-5854 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Opening a maliciously crafted HTML file may lead to information disclosure or cross-site scripting Description: Launch Services does not handle HTML files as potentially unsafe content. By enticing a user to open a maliciously crafted HTML file, an attacker may cause the disclosure of sensitive information or cross-site scripting. This update addresses the issue by handling HTML files as potentially unsafe content. Credit to Michal Zalewski of Google Inc. for reporting this issue. Launch Services CVE-ID: CVE-2007-6165 Available for: Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Opening an executable mail attachment may lead to arbitrary code execution with no warning Description: An implementation issue exists in Launch Services, which may allow executable mail attachments to be run without warning when a user opens a mail attachment. This update addresses the issue by warning the user before launching executable mail attachments. This issue does not affect systems prior to Mac OS X 10.5. Credit to Xeno Kovah for reporting this issue. Mail CVE-ID: CVE-2007-5855 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: SMTP accounts set up through Account Assistant may use plaintext authentication even when MD5 Challenge-Response authentication is available Description: When setting up an SMTP account through Account Assistant, if SMTP authentication is selected, and if the server supports only MD5 Challenge-Response authentication and plaintext authentication, Mail defaults to using plaintext authentication. This update addresses the issue by ensuring that the most secure available mechanism is used. This issue does not affect systems running Mac OS X 10.5 or later. perl CVE-ID: CVE-2007-5116 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Parsing regular expressions may lead to arbitrary code execution Description: A length calculation issue exists in the polymorphic opcode support in the Perl Regular Expression compiler. This may allow an attacker to cause memory corruption leading to arbitrary code execution by switching from byte to Unicode (UTF) characters in a regular expression. This update addresses the issue by recomputing the length if the character encoding changes. Credit to Tavis Ormandy and Will Drewry of Google Security Team for reporting this issue. python CVE-ID: CVE-2007-4965 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Processing image content with imageop module may lead to an unexpected application termination or arbitrary code execution Description: Multiple integer overflows exist in python's imageop module. These may cause a buffer overflow to occur in applications which use the module to process maliciously crafted image content. This may lead to an unexpected application termination or arbitrary code execution. This updated addresses the issue by performing additional validation of image content. Quick Look CVE-ID: CVE-2007-5856 Available for: Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Previewing a file with QuickLook enabled may lead to the disclosure of sensitive information Description: When previewing an HTML file, plug-ins are not restricted from making network requests. This may lead to the disclosure of sensitive information. This update addresses the issue by disabling plug-ins. This issue does not affect systems prior to Mac OS X 10.5. Quick Look CVE-ID: CVE-2007-5857 Available for: Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Previewing a movie file may access URLs contained in the movie Description: Creating an icon for a movie file, or previewing that file using QuickLook may access URLs contained in the movie. This update addresses the issue by disabling HREFTrack while browsing movie files. This issue does not affect systems prior to Mac OS X 10.5, or systems with QuickTime 7.3 installed. Credit to Lukhnos D. Liu of Lithoglyph Inc. for reporting this issue. ruby CVE-ID: CVE-2007-5770 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Multiple SSL certificate validation issues exist in ruby libraries Description: Multiple ruby libraries are affected by SSL certificate validation issues. This may lead to man-in-the-middle attacks against applications that use an affected library. This update addresses the issues by applying the ruby patch. ruby CVE-ID: CVE-2007-5379, CVE-2007-5380, CVE-2007-6077 Available for: Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Multiple vulnerabilities exist in Rails 1.2.3 Description: Multiple vulnerabilities exist in Rails 1.2.3, which may lead to the disclosure of sensitive information. This update addresses the issue by updating Rails to version 1.2.6. This issue does not affect systems prior to Mac OS X 10.5. Safari CVE-ID: CVE-2007-5858 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Visiting a malicious website may result in the disclosure of sensitive information Description: WebKit allows a page to navigate the subframes of any other page. Visiting a maliciously crafted web page could trigger a cross-site scripting attack, which may lead to the disclosure of sensitive information. This update addresses the issue by implementing a stricter frame navigation policy. Safari RSS CVE-ID: CVE-2007-5859 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Accessing a maliciously crafted feed: URL may lead to an application termination or arbitrary code execution Description: A memory corruption issue exists in Safari's handling of feed: URLs. By enticing a user to access a maliciously crafted URL, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of feed: URLs and providing an error message in case of an invalid URL. This issue does not affect systems running Mac OS X 10.5 or later. Samba CVE-ID: CVE-2007-4572, CVE-2007-5398 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Multiple vulnerabilities in Samba Description: Multiple vulnerabilities exist in Samba, the most serious of which is remote code execution. This update addresses the issues by applying patches from the Samba project. Further information is available via the Samba web site at http://www.samba.org/samba/history/security.html CVE-2007-4138 does not affect systems prior to Mac OS X 10.5. Credit to Alin Rad Pop of Secunia Research for reporting this issue. Shockwave Plug-in CVE-ID: CVE-2006-0024 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: Opening maliciously crafted Shockwave content may lead to arbitrary code execution Description: Multiple vulnerabilities exist in Shockwave Player. By enticing a user to open maliciously crafted Shockwave content, an attacker may cause arbitrary code execution. This update addresses the issues by updating Shockwave Player to version 10.1.1.016. Credit to Jan Hacker of ETH Zurich for reporting the problem in Shockwave. SMB CVE-ID: CVE-2007-3876 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A local user may be able to execute arbitrary code with system privileges Description: A stack buffer overflow issue exists in the code used by the mount_smbfs and smbutil applications to parse command line arguments, which may allow a local user to cause arbitrary code execution with system privileges. This update addresses the issue through improved bounds checking. This issue does not affect systems running Mac OS X 10.5 or later. Credit to Sean Larsson of VeriSign iDefense Labs for reporting this issue. Software Update CVE-ID: CVE-2007-5863 Available for: Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: A man-in-the-middle attack could cause Software Update to execute arbitrary commands Description: When Software Update checks for new updates, it processes a distribution definition file which was sent by the update server. By intercepting requests to the update server, an attacker can provide a maliciously crafted distribution definition file with the "allow-external-scripts" option, which may cause arbitrary command execution when a system checks for new updates. This update addresses the issue by disallowing the "allow-external-scripts" option in Software Update. This issue does not affect systems prior to Mac OS X 10.5. Credit to Moritz Jodeit for reporting this issue. Spin Tracer CVE-ID: CVE-2007-5860 Available for: Mac OS X v10.5.1, Mac OS X Server v10.5.1 Impact: A local user may be able to execute arbitrary code with system privileges Description: An insecure file operation exists in SpinTracer's handling of output files, which may allow a local user to execute arbitrary code with system privileges. This update addresses the issue through improved handling of output files. This issue does not affect systems prior to Mac OS X 10.5. Credit to Kevin Finisterre of DigitalMunition for reporting this issue. Spotlight CVE-ID: CVE-2007-5861 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Downloading a maliciously crafted .xls file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in the Microsoft Office Spotlight Importer. By enticing a user to download a maliciously crafted .xls file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of .xls files. This issue does not affect systems running Mac OS X 10.5 or later. tcpdump CVE-ID: CVE-2007-1218, CVE-2007-3798 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Multiple vulnerabilities in tcpdump Description: Multiple vulnerabilities exist in tcpdump, the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating tcpdump to version 3.9.7. This issue does not affect systems running Mac OS X 10.5 or later. XQuery CVE-ID: CVE-2007-1659, CVE-2007-1660, CVE-2007-1661, CVE-2007-1662, CVE-2007-4766, CVE-2007-4767, CVE-2007-4768 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Multiple vulnerabilities in the handling of regular expressions Description: Multiple vulnerabilities exist in the Perl Compatible Regular Expressions (PCRE) library used by XQuery, the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating PCRE to version 7.3. Further information is available via the PCRE web site at http://www.pcre.org/ This issue does not affect systems running Mac OS X 10.5 or later. Credit to Tavis Ormandy and Will Drewry of Google Security Team for reporting this issue. Security Update 2007-009 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.5.1 The download file is named: "SecUpd2007-009.dmg" Its SHA-1 digest is: 9d1743b2cd15f3934d82cc6341c3142a3d16becf For Mac OS X v10.4.11 (Universal) The download file is named: "SecUpd2007-009Univ.dmg" Its SHA-1 digest is: ac07f4850b812af0761f859bb4d63c2e0f2a6113 For Mac OS X v10.4.11 (PPC) The download file is named: "SecUpd2007-009Ti.dmg" Its SHA-1 digest is: 2e75b99b1a10fb973807cba14b99080da38ad288 Information will also be posted to the Apple Security Updates web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.0.867 wsBVAwUBR2bb8cgAoqu4Rp5tAQiLfAgAgpfERDpCFRl9h0wgbMdVRb614ImnUGQ+ E+N2/7XJrZo7/JgHs9Vwg7r3FhDrR23DYUKi9ldCZ437lwPGjSOAAG7ZNBYqPEYf 31w5l2QAYXPf1tmVjAOHgKovpsF/yLY/EPfsA2UbGgE1A9TpsCi6W0l2+KyP3/u1 MGKHa8JUNt0MegObdcySJsY8qWtpYPUIeEvbA9kkFP9CzwHT4cviwrcIXHxf5jku AcvKnwBG9UKV/hiaJTv19CKP7zltnhkSVcok0MVBUvGAsttT20ipyeRnlQMfTIvE ratDjXxkAhsNnPQbzVPvvyJcVa6eSmngqWnQhWYGe1cVV/IhcEWThA== =2Wg5 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-12-14 Java Release 6 for Mac OS X 10.4
by Apple Product Security 14 Dec '07

14 Dec '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-12-14 Java Release 6 for Mac OS X 10.4 Java Release 6 for Mac OS X 10.4 is now available and addresses the following issues: Java CVE-ID: CVE-2007-5862 Available for: Mac OS X v10.4.10, Mac OS X v10.4.11, Mac OS X Server v10.4.10, Mac OS X Server v10.4.11 Impact: A malicious webpage can remove or insert keychain items Description: An access check may be bypassed for Keychain updates. A specially crafted Java applet may be able to add or remove items from a user's Keychain, without prompting the user. This update addresses the issue through an improved access check. This issue does not affect systems running Mac OS X v10.5 and later. Credit to Bruno Harbulot of the University of Manchester for reporting this issue. Java CVE-ID: CVE-2006-4339, CVE-2006-6731, CVE-2006-6736, CVE-2006-6745, CVE-2007-0243, CVE-2007-2435, CVE-2007-3004, CVE-2007-3005, CVE-2007-3504, CVE-2007-3698, CVE-2007-3922, CVE-2007-4381, CVE-2007-5232 Available for: Mac OS X v10.4.10, Mac OS X v10.4.11, Mac OS X Server v10.4.10, Mac OS X Server v10.4.11 Impact: Multiple vulnerabilities exist in Java 1.4 Description: Multiple vulnerabilities exist in Java 1.4, the most serious of which may lead to arbitrary code execution and privilege escalation. These are addressed by updating Java 1.4 to version 1.4.2_16. These issues are already addressed in systems running Mac OS X v10.5 and later. Java CVE-ID: CVE-2006-4339, CVE-2006-6731, CVE-2006-6745, CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789, CVE-2007-3004, CVE-2007-3005, CVE-2007-3503, CVE-2007-3504, CVE-2007-3655, CVE-2007-3698, CVE-2007-3922, CVE-2007-4381, CVE-2007-5232 Available for: Mac OS X v10.4.10, Mac OS X v10.4.11, Mac OS X Server v10.4.10, Mac OS X Server v10.4.11 Impact: Multiple vulnerabilities exist in J2SE 5.0 Description: Multiple vulnerabilities exist in J2SE 5.0, the most serious of which may lead to arbitrary code execution and privilege escalation. These are addressed by updating J2SE 5.0 to version 1.5.0_13. These issues are already addressed in systems running Mac OS X v10.5 and later. Java Release 6 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.10 and Mac OS X v10.4.11 The download file is named: "JavaForMacOSX10.4Release6.dmg" Its SHA-1 digest is: ee4e261070354b0f95f88a92a1b00f8cf39886c4 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.0.867 wsBVAwUBR2LK18gAoqu4Rp5tAQgG8gf/UCD9npaJL3to97F+On2L7AUmEXgKh7N0 mrT0GErNHmUiXaLHrAJ5GH2e/SYVGpfV9PlyV2iNAx4d1lXhM0hXAwINZfTDy0nm ZpBBvwRjWeZSRaJk6saM0vIYt+tCQMREFR7m5qBrnteo2wA3bUuFBZmwJMyWz3ls boTozFrbr9mDzk/mTnTxHvEDZAAEbH21aqyZPEuFK8FwGbrCffIKl+EmUPiMxjhe SxqUl4eGep+WcwosOdsxqwlo9ia9UcO21zGlgr75Ibu5W/xvoHO+yAHHufm6CI4b JpU3/tDvdyPUMFDJayNik622GlbZUNEIfDoasOfKPiyHv93gCValtg== =CNOz -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-12-13 QuickTime 7.3.1
by Apple Product Security 13 Dec '07

13 Dec '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2007-12-13 QuickTime 7.3.1 QuickTime 7.3.1 is now available and addresses the following issues: QuickTime CVE-ID: CVE-2007-6166 Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista / XP SP2 Impact: Viewing a maliciously crafted RTSP movie may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in QuickTime's handling of Real Time Streaming Protocol (RTSP) headers. By enticing a user to view a maliciously crafted RTSP movie, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by ensuring that the destination buffer is sized to contain the data. QuickTime CVE-ID: CVE-2007-4706 Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista / XP SP2 Impact: Viewing a maliciously crafted QTL file may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in QuickTime's handling of QTL files. By enticing a user to view a maliciously crafted QTL file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. QuickTime CVE-ID: CVE-2007-4707 Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista / XP SP2 Impact: Multiple vulnerabilities in QuickTime's Flash media handler Description: Multiple vulnerabilities exist in QuickTime's Flash media handler, the most serious of which may lead to arbitrary code execution. With this update, the Flash media handler in QuickTime is disabled except for a limited number of existing QuickTime movies that are known to be safe. Credit to Tom Ferris of Adobe Secure Software Engineering Team (ASSET), Mike Price of McAfee Avert Labs, and security researchers Lionel d'Hauenens & Brian Mariani of Syseclabs for reporting this issue. QuickTime 7.3.1 may be obtained from the Software Update application, or from the Apple Downloads site: http://www.apple.com/support/downloads/ For Mac OS X v10.5 The download file is named: "QuickTime731_Leopard.dmg" Its SHA-1 digest is: ede5a96f039d6acdf507ce96869f5ee481acd1ed For Mac OS X v10.4.9 or later The download file is named: "QuickTime731_Tiger.dmg" Its SHA-1 digest is: 27be64dafbc4b0efb7671ca5acd14941b1ed8f98 For Mac OS X v10.3.9 The download file is named: "QuickTime731_Panther.dmg" Its SHA-1 digest is: 5f3b199e385efe9cdca84d6ffc359c1e712705b6 QuickTime 7.3.1 for Windows Vista / XP SP2 The download file is named: "QuickTimeInstaller.exe" Its SHA-1 digest is: 9756effce45aa257bc5653a78b273b8f421cbb4c QuickTime 7.3.1 with iTunes for Windows Vista / XP SP2 The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: e0f384fbf385f98fce3431f084b474bd092312a3 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQEVAwUBR2G4ycgAoqu4Rp5tAQK20wgArU87tTwK72+IE4zfczhExd439iwKe99q YxVtkqbLDW8+nXeee5se5DGbMqJFG7NhQyFPeBYRdN82H+uhvTq2RQybpWaH8UoH rqaOM6lzbS0p+EYBW2MUoOu0WkxmgZnMYRQq3Fg5/Q/rua9OG4hMMVrJ5rawFw8N 3/XyjgXQ+KmFJKtd9vsR63+AjsiPqwBd+94PSYokkIHxrVvG2HPyaQKQDfJliYJZ /QGu8CfKsRCMhvMvukgayAHDvBDnKty5zfBp1IO3IDoqTztIqwWzT7JUA92u5udq FKyO2bkMoQCDO8wIOUF4UU9kAerFBZLpl+VO93tHwNUgrVEhUA3O6Q== =Qrx4 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0