June 2008 - Security-announce

APPLE-SA-2008-06-30 Safari 3.1.2 for Mac OS X v10.4.11
by Apple Product Security 30 Jun '08

30 Jun '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-06-30 Safari 3.1.2 for Mac OS X v10.4.11 Safari 3.1.2 is now available for Mac OS X v10.4.11 and addresses the following issue: WebKit CVE-ID: CVE-2008-2307 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in WebKit's handling of JavaScript arrays. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. This issue is addressed in Safari 3.1.2 for Windows XP or Vista, and also in systems running Mac OS X v10.5.4. Credit to James Urquhart for reporting this issue. Safari 3.1.2 for Mac OS X v10.4.11 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ The download file is named: "Safari312UpdTiger.dmg" Its SHA-1 digest is: 92dcca834e790d719953a649aae6b28e92de4717 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.2.1608 wsBVAwUBSGlP6XkodeiKZIkBAQgA7wf+OGHrGNBWsY9rWJZcWyxpZa42aXcwWqAz ZC8dO6+rpSo/5bKaop+6wfPrk6zjii7B6pE6Y1FvsD+TBZsst7UGLRucxM6oalkn kiK6EoVktwZRRuvlK5/ZStbhYBt/7kwgbwDovwsIZ3CAK0DyhKDLsNd2GCzftcLc nBg37SHZz1qv6FT+eBBA9+fbegmUpPn7bTM5DB3hzBIGBTS50PMzEjBLHhrRrikS KxZDLX48HesmFtlSK///klNQlzbriXAMXPU+FbO50NWLzlco0ate/t4p0oRzDbEx hIErFJNLXnLZ0rOUCLnBweuyRnlXI1r9khSuWz3Tbts7s/3cART1Lw== =TzZN -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-06-30 Security Update 2008-004 and Mac OS X v10.5.4
by Apple Product Security 30 Jun '08

30 Jun '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-06-30 Security Update 2008-004 and Mac OS X v10.5.4 Security Update 2008-004 and Mac OS X v10.5.4 are now available and address the following issues: Alias Manager CVE-ID: CVE-2008-2308 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Resolving an alias containing maliciously crafted volume mount information may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in the handling of AFP volume mount information in an alias data structure. Resolving an alias containing maliciously crafted volume mount information may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of alias data structures. This issue only affects Intel- based systems running Mac OS X 10.5.1 or earlier. CoreTypes CVE-ID: CVE-2008-2309 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: Users are not warned before opening certain potentially unsafe content types Description: This update adds .xht and .xhtm files to the system's list of content types that will be flagged as potentially unsafe under certain circumstances, such as when they are downloaded from a web page. While these content types are not automatically launched, if manually opened they could lead to the execution of a malicious payload. This update improves the system's ability to notify users before handling .xht and .xhtm files. On Mac OS X v10.4 this functionality is provided by the Download Validation feature. On Mac OS X v10.5 this functionality is provided by the Quarantine feature. Credit to Brian Mastenbrook for reporting this issue. c++filt CVE-ID: CVE-2008-2310 Available for: Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: Passing a maliciously crafted string to c++filt may lead to an unexpected application termination or arbitrary code execution Description: A format string issue exists in c++filt, which is a debugging tool used to demangle C++ and Java symbols. Passing a maliciously crafted string to c++filt may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of format strings. This issue does not affect systems prior to Mac OS X 10.5. Dock CVE-ID: CVE-2008-2314 Available for: Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: A person with physical access may be able to bypass the screen lock Description: When the system is set to require a password to wake from sleep or screen saver, and hot corners are set for Expose, a person with physical access may be able to access the system without entering a password. This update addresses the issue by disabling hot corners when the screen lock is active. This issue does not affect systems prior to Mac OS X 10.5. Credit to Andrew Cassell of Marine Spill Response Corporation for reporting this issue. Launch Services CVE-ID: CVE-2008-2311 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: A race condition exists in the download validation of symbolic links, when the target of the link changes during the narrow time window of validation. If the "Open 'safe' files" preference is enabled in Safari, visiting a maliciously crafted website may cause a file to be opened on the user's system, resulting in arbitrary code execution. This update addresses the issue by performing additional validation of downloaded files. This issue does not affect systems running Mac OS X 10.5 or later. Net-SNMP CVE-ID: CVE-2008-0960 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: A remote attacker may be able to spoof an authenticated SNMPv3 packet Description: An issue exists in Net-SNMP's SNMPv3 authentication, which may allow maliciously crafted packets to bypass the authentication check. This update addresses the issue by performing additional validation of SNMPv3 packets. Additional information is available via http://www.kb.cert.org/vuls/id/878044 Ruby CVE-ID: CVE-2008-2662, CVE-2008-2663, CVE-2008-2664, CVE-2008-2725, CVE-2008-2726 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: Running a Ruby script that uses untrusted input to access strings or arrays may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues exist in Ruby's handling of strings and arrays, the most serious of which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of strings and arrays. Ruby CVE-ID: CVE-2008-1145 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: If WEBRick is running, a remote attacker may be able to access files protected by WEBrick's :NondisclosureName option Description: The :NondisclosureName option in the Ruby WEBrick toolkit is used to restrict access to files. Requesting a file name which uses unexpected capitalization may bypass the :NondisclosureName restriction. This update addresses the issue by additional validation of file names. Additional information is available via http://www.ruby-lang.org/en/news/2008/03/03/webrick- file-access-vulnerability/ The directory traversal issue described in the advisory does not affect Mac OS X. SMB File Server CVE-ID: CVE-2008-1105 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: A remote attacker may be able to cause an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in the handling of SMB packets. Sending malicious SMB packets to a SMB server, or connecting to a malicious SMB server, may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking on the length of received SMB packets. Credit to Alin Rad Pop of Secunia Research for reporting this issue. System Configuration CVE-ID: CVE-2008-2313 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A local user may be able to execute arbitrary code with the privileges of new users Description: A local user may be able to populate the User Template directory with files that will become part of the home directory when a new user is created. This could allow arbitrary code execution with the privileges of the new user. This update addresses the issue by applying more restrictive permissions on the User Template directory. This issue does not affect systems running Mac OS X 10.5 or later. Credit to Andrew Mortensen of the University of Michigan for reporting this issue. Tomcat CVE-ID: CVE-2005-3164, CVE-2007-1355, CVE-2007-2449, CVE-2007-2450, CVE-2007-3382, CVE-2007-3383, CVE-2007-5333, CVE-2007-3385, CVE-2007-5461 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Multiple vulnerabilities in Tomcat 4.1.36 Description: Tomcat version 4.x is bundled on Mac OS X v10.4.11 systems. Tomcat on Mac OS X v10.4.11 is updated to version 4.1.37 to address several vulnerabilities, the most serious of which may lead to a cross-site scripting attack. Further information is available via the Tomcat site at http://tomcat.apache.org/ Tomcat version 6.x is bundled with Mac OS X v10.5 systems. VPN CVE-ID: CVE-2007-6276 Available for: Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: Remote attackers may be able to cause an unexpected application termination Description: A divide by zero issue exists in the virtual private network daemon's handling of load balancing information. Processing a maliciously crafted UDP packet may lead to an unexpected application termination. This issue does not lead to arbitrary code execution. This update addresses the issue by performing additional validation of load balancing information. This issue does not affect systems prior to Mac OS X 10.5. WebKit CVE-ID: CVE-2008-2307 Available for: Mac OS X v10.5 through v10.5.3, Mac OS X Server v10.5 through v10.5.3 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in WebKit's handling of JavaScript arrays. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Along with this fix, the version of Safari for Mac OS X v10.5.4 is updated to 3.1.2. For Mac OS X v10.4.11 and Windows XP / Vista, this issue is addressed in Safari v3.1.2 for those systems. Credit to James Urquhart for reporting this issue. Security Update 2008-004 and Mac OS X v10.5.4 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The Software Update utility will present the update that applies to your system configuration. Only one is needed, either Security Update 2008-004 or Mac OS X v10.5.4. For Mac OS X v10.5.3 The download file is named: "MacOSXUpd10.5.4.dmg" Its SHA-1 digest is: 455d911a23ba222cc962298ad8ad15b2a234ca65 For Mac OS X v10.5 - v10.5.2 The download file is named: "MacOSXUpdCombo10.5.4.dmg" Its SHA-1 digest is: 490962bf712b2d801d08f42ca66b8a4541e9da16 For Mac OS X Server v10.5.3 The download file is named: "MacOSXServerUpd10.5.4.dmg" Its SHA-1 digest is: bfeda72164fa17564b25d205d14288fe795df127 For Mac OS X Server v10.5 - v10.5.2 The download file is named: "MacOSXServerUpdCombo10.5.4.dmg" Its SHA-1 digest is: d2d2fb234333c11348eb90f91d9d1720a952605a For Mac OS X v10.4.11 (Intel) The download file is named: "SecUpd2008-004Intel.dmg" Its SHA-1 digest is: a14f144316eb620ccd28e12887e13ec0d6f46e6a For Mac OS X v10.4.11 (PowerPC) The download file is named: "SecUpd2008-004PPC.dmg" Its SHA-1 digest is: b5436e04ce30392bc5131272f6b7f5582bc9fe27 For Mac OS X Server v10.4.11 (Universal) The download file is named: "SecUpdSrvr2008-004Univ.dmg" Its SHA-1 digest is: 9b68b34f88ff8110166c1a57fd05756982f1e390 For Mac OS X Server v10.4.11 (PowerPC) The download file is named: "SecUpdSrvr2008-004PPC.dmg" Its SHA-1 digest is: 35ef81cc092a74af80b2ef792c72645c636a4ae5 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.2.1608 wsBVAwUBSGk5pXkodeiKZIkBAQgzWwgAo3I2TgErwkXZMwlw9/Bk3uy//inoPSI5 2/WIC31SQgGF6S3ogzp7oDPApFvRyhZl4FMPulc2GL2UL9nJ5fSRF4JbKYmMqYyo oF8D+rPbUUDUyx7tndZTcit+zHJ1OJU+LZ2QNkKX1NdsU0v6+Tv0dD8qEx6RhRuG Nu+NZn8/3duceq/UzO+mir1HMIvXnGTYgGcj2L5SNauHla/XJtmARyfnCfDjE5c3 PUeHgvXJCLRIt/6a10RtbGcHWeY8tU2jCU/WmA41xUjdg3CkcDj6nbJfMn9t5PlU knlC0rMoKBJiCBln3YX+DTWBp+xUhY7JAVOE8pBpWvmk98Ja8w4sLg== =CXa3 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-06-19 Safari v3.1.2 for Windows
by Apple Product Security 19 Jun '08

19 Jun '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-06-19 Safari v3.1.2 for Windows Safari v3.1.2 for Windows is now available and addresses the following issues: Safari CVE-ID: CVE-2008-1573 Available for: Windows XP or Vista Impact: Viewing a maliciously crafted BMP or GIF image may lead to information disclosure Description: An out-of-bounds memory read may occur in the handling of BMP and GIF images, which may lead to the disclosure of memory contents. This update addresses the issue by performing additional validation of BMP and GIF images. This issue is addressed in systems running Mac OS X v10.5.3, and in Mac OS X v10.4.11 with Security Update 2008-003. Credit to Gynvael Coldwind of Hispasec for reporting this issue. Safari CVE-ID: CVE-2008-2540 Available for: Windows XP or Vista Impact: Saving untrusted files to the Windows desktop may lead to the execution of arbitrary code Description: An issue exists in how the Windows desktop handles executables. Saving an untrusted file to the Windows desktop may trigger the issue, and lead to the execution of arbitrary code. Web browsers are a means by which files may be saved to the desktop. To help mitigate this issue, the Safari browser has been updated to prompt the user prior to saving a download file. Also, the default download location is changed to the user's Downloads folder on Windows Vista, and to the user's Documents folder on Windows XP. This issue does not exist on systems running Mac OS X. Additional information is available from http://www.microsoft.com/technet/security/advisory/953818.mspx which credits Aviv Raff with reporting the issue. Safari CVE-ID: CVE-2008-2306 Available for: Windows XP or Vista Impact: Visiting a malicious website which is in a trusted Internet Explorer zone may lead to the automatic execution of arbitrary code Description: If a website is in an Internet Explorer 7 zone with the "Launching applications and unsafe files" setting set to "Enable", or if a website is in the Internet Explorer 6 "Local intranet" or "Trusted sites" zone, Safari will automatically launch executable files that are downloaded from the site. This update addresses the issue by not automatically launching downloaded executable files, and by prompting the user before downloading a file if the "always prompt" setting is enabled. This issue does not exist on systems running Mac OS X. Credit to Will Dormann of CERT/CC for reporting this issue. WebKit CVE-ID: CVE-2008-2307 Available for: Windows XP or Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in WebKit's handling of JavaScript arrays. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to James Urquhart for reporting this issue. Safari v3.1.2 for Windows is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Windows XP or Vista The download file is named: "SafariSetup.exe" Its SHA-1 digest is: c63db818658532d3ff2762378b0b7b7e6aace0d6 Safari+QuickTime for Windows XP or Vista The file is named: "SafariQuickTimeSetup.exe" Its SHA-1 digest is: 22ebca0a88b5814e22f015daea1be27489e6e7be Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.2.1608 wsBVAwUBSFqRZHkodeiKZIkBAQgxiAf9HapNeskNLM++Bjfc3T37jpGOe1LRPdMc GNuCnUIrHzVcr5ZenYRwndz1LtH0Ui6kCo7sazGYAbqEZjNmFUusdByOIo6KikKf ejntmZsgRGLh7qlTOCwBO/9DptAfrGWQZMqhES1u/enfKjBgg/2ijq/DZhhBlTrA QQBp6xtDk8aIiIui8UdYFSauyoSOAuomaHTtMU2Wis6h2hHE8rmwG9/9TRZo5Woc SkzeDi0pjxpyCrEQ3LARBxMd3eEaZx/+2PQeY30m3VKKpenUuj+G7D7Ejz+Uu7Nk ej6u3zdHmnHAcoAE9gmOPxKCZ0XemzuULzi824EN+aLkqHz0CgWNSg== =iDKS -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-06-09 QuickTime 7.5
by Apple Product Security 10 Jun '08

10 Jun '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-06-09 QuickTime 7.5 QuickTime 7.5 is now available and addresses the following issues: QuickTime CVE-ID: CVE-2008-1581 Available for: Windows Vista, XP SP2 Impact: Opening a maliciously crafted PICT image file may lead to an unexpected application termination or arbitrary code execution Description: An issue in QuickTime's handling of PixData structures when processing a PICT image may result in a heap buffer overflow. Opening a maliciously crafted PICT image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. This issue does not affect systems running Mac OS X. Credit to Dyon Balding of Secunia Research for reporting this issue. QuickTime CVE-ID: CVE-2008-1582 Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 Impact: Opening a maliciously crafted AAC-encoded media content may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in QuickTime's handling of AAC-encoded media content. Opening a maliciously crafted media file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of media files. Credit to Dave Soldera of NGS Software, and Jens Alfke for reporting this issue. QuickTime CVE-ID: CVE-2008-1583 Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 Impact: Opening a maliciously crafted PICT image file may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in QuickTime's handling of PICT images. Opening a maliciously crafted PICT image file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Liam O Murchu of Symantec for reporting this issue. QuickTime CVE-ID: CVE-2008-1584 Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 Impact: Viewing maliciously crafted Indeo video media content may lead to an unexpected application termination or arbitrary code execution Description: An issue in QuickTime's handling of Indeo video codec content may result in a stack buffer overflow. Viewing a maliciously crafted movie file with Indeo video codec content may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by not rendering Indeo video codec content. Credit to an anonymous researcher working with TippingPoint's Zero Day Initiative for reporting this issue. QuickTime CVE-ID: CVE-2008-1585 Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 Impact: Playing maliciously crafted QuickTime content in QuickTime Player may lead to arbitrary code execution Description: A URL handling issue exists in QuickTime's handling of file: URLs. This may allow arbitrary applications and files to be launched when a user plays maliciously crafted QuickTime content in QuickTime Player. This update addresses the issue by revealing files in Finder or Windows Explorer rather than launching them. Credit to Vinoo Thomas and Rahul Mohandas of McAfee Avert Labs, and Petko D. (pdp) Petkov of GNUCITIZEN working with TippingPoint's Zero Day Initiative for reporting this issue. QuickTime 7.5 may be obtained from the Software Update application, or from the QuickTime Downloads site: http://www.apple.com/quicktime/download/ For Mac OS X v10.5 or later The download file is named: "QuickTime75_Leopard.dmg" Its SHA-1 digest is: 207c4dcc6a6adc8e600598db3ce036c40a3926f6 For Mac OS X v10.4.9 through Mac OS X v10.4.11 The download file is named: "QuickTime75_Tiger.dmg" Its SHA-1 digest is: 5b89879be97d93e6560f95fb5000fcb0a33fbcaa For Mac OS X v10.3.9 The download file is named: "QuickTime75_Panther.dmg" Its SHA-1 digest is: 92dd692563e685ae535b9272c1ef4f3c5bdd0eef For Windows Vista / XP SP2 The download file is named: "QuickTimeInstaller.exe" Its SHA-1 digest is: 81d70a503adb132048f744c3ffc0cea487cf2cac QuickTime with iTunes for Windows XP or Vista The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 8123286fffa53d4ae2c187edccab778fb0f5f34f Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.2.1608 wsBVAwUBSE3I+HkodeiKZIkBAQiNvggAlLOvEaScjlj0Y4ZOg3bgjXHgmQtMIGFG iG2/0v9tD0xYTfUD/1Yhu58CJ5wTvhVFx0KuSXb9EUUdEZXpCkvJGqG5W9MK1Kmq iPE7YIPGHBit2/xG4VE4U2vMh6YPtQUpSqAUhEhWU1a2o5+6C8kG1TUBeTf+hUlK RoWrlf41YMlmrgqT45ZqeT2SXEtGLgb0qYg6Unroks0pYB25xJUUl87/Q4dNKLOg N+mxsPvQwI8CY3EsigQGG7BN14jXSl+44fXQyP/Lfljy/YPjUMT/gXk7l+pP+MOI 9x7qrBkEmN54rSDK+UfB/oFaF3Cwa1csKxT+rg82DUcHnQviaxI/zw== =2/AX -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0