August 2009 - Security-announce

APPLE-SA-2009-08-12-1 Security Update 2009-004
by Apple Product Security 12 Aug '09

12 Aug '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-08-12-1 Security Update 2009-004 Security Update 2009-004 is now available and addresses the following: BIND CVE-ID: CVE-2009-0696 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: A remote attacker may be able to cause the DNS server to unexpectedly terminate Description: A logic issue in the handling of dynamic DNS update messages may cause an assertion to be triggered. By sending a maliciously crafted update message to the BIND DNS server, a remote attacker may be able to interrupt the BIND service. The issue affects servers which are masters for one or more zones, regardless of whether they accept updates. BIND is included with Mac OS X and Mac OS X Server but it is not enabled by default. This update addresses the issue by properly rejecting messages with a record of type 'ANY' where an assertion would previously have been raised. Security Update 2009-004 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.5.8 and Mac OS X Server 10.5.8 The download file is named: "SecUpd2009-004.dmg" Its SHA-1 digest is: 9fefe6349e8fb9ed47d44b572a11e6c66daf4dac For Mac OS X v10.4.11 (Intel) The download file is named: "SecUpd2009-004Intel.dmg" Its SHA-1 digest is: 28e1d0ad3a97f3b5e17ebe6367532e103b69d3a0 For Mac OS X v10.4.11 (PPC) The download file is named: "SecUpd2009-004PPC.dmg" Its SHA-1 digest is: e9ed8d53d6bc055e44768f1d1e894f505f1fd6fe For Mac OS X Server v10.4.11 (Universal) The download file is named: "SecUpdSrvr2009-004Univ.dmg" Its SHA-1 digest is: dfb57125139c058655b847135bff50216f3ea577 For Mac OS X Server v10.4.11 (PPC) The download file is named: "SecUpdSrvr2009-004PPC.dmg" Its SHA-1 digest is: c95b0c305d7d3f365b7ff768b995da38529ec393 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKgw9WAAoJEHkodeiKZIkBDHEH/05S2RKm3kXqm73+tzlG9tH0 mDjalEZELKEeYLCfQebcqAFISDW05jNPiHHteCwiR/GYY52zmvnBYWc0mfjmHI97 9OaITgYDEO6e8cnToSgANfAvJ/tZfmC79F/eDjbSM1XTIJqD4pdyiQmZxTby9zpj APSO1xjxUFsgo5CqScxK3al9JIUs8yo/R+iA/VT+92JurR7m/wEma90CRggSfFKk gVZLhoOXAID3+Qxq5L20kyUBgI53WoAm8IKuq/0DULmZBrP5k4PAJCwBZHwdgWR1 nVmf6IN5BCGhyRGgbAMxo+pnBHsdofVkaD2ia9fh64U5MmB1rcUSFHk4TMMpFXM= =yJAK -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-08-11-1 Safari 4.0.3
by Apple Product Security 11 Aug '09

11 Aug '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-08-11-1 Safari 4.0.3 Safari 4.0.3 is now available and addresses the following: CoreGraphics CVE-ID: CVE-2009-2468 Available for: Windows XP and Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in the drawing of long text strings. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Will Drewry of Google Inc for reporting this issue. ImageIO CVE-ID: CVE-2009-2188 Available for: Windows XP and Vista Impact: Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in the handling of EXIF metadata. Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Safari CVE-ID: CVE-2009-2196 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.7, Mac OS X Server v10.5.7, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows XP and Vista Impact: A maliciously crafted website may be promoted into Safari's Top Sites view Description: Safari 4 introduced the Top Sites feature to provide an at-a-glance view of a user's favorite websites. It is possible for a malicious website to promote arbitrary sites into the Top Sites view through automated actions. This could be used to facilitate a phishing attack. This issue is addressed by preventing automated website visits from affecting the Top Sites list. Only websites that the user visits manually can be included in the Top Sites list. As a note, Safari enables fraudulent site detection by default. Since the introduction of the Top Sites feature, fraudulent sites are not displayed in the Top Sites view. Credit to Inferno of SecureThoughts.com for reporting this issue. WebKit CVE-ID: CVE-2009-2195 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.7, Mac OS X Server v10.5.7, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows XP and Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in WebKit's parsing of floating point numbers. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit: Apple. WebKit CVE-ID: CVE-2009-2200 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.7, Mac OS X Server v10.5.7, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows XP and Vista Impact: Visiting a maliciously crafted website and clicking "Go" when viewing a malicious plug-in dialog may lead to the disclosure of sensitive information Description: WebKit allows the pluginspage attribute of the 'embed' element to reference file URLs. Clicking "Go" in the dialog that appears when an unknown plug-in type is referenced will redirect to the URL listed in the pluginspage attribute. This may allow a remote attacker to launch file URLs in Safari, and lead to the disclosure of sensitive information. This update addresses the issue by restricting the pluginspage URL scheme to http or https. Credit to Alexios Fakos of n.runs AG for reporting this issue. WebKit CVE-ID: CVE-2009-2199 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.7, Mac OS X Server v10.5.7, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows XP and Vista Impact: Look-alike characters in a URL could be used to masquerade a website Description: The International Domain Name (IDN) support and Unicode fonts embedded in Safari could be used to create a URL which contains look-alike characters. These could be used in a malicious website to direct the user to a spoofed site that visually appears to be a legitimate domain. This update addresses the issue by supplementing WebKit's list of known look-alike characters. Look-alike characters are rendered in Punycode in the address bar. Credit to Chris Weber of Casaba Security, LLC for reporting this issue. Safari 4.0.3 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Mac OS X v10.5.7 and Mac OS X v10.5.8 The download file is named: Safari4.0.3Leo.dmg Its SHA-1 digest is: 9b04a33efe6b44083b064dda990b0174402ce107 Safari for Mac OS X v10.4.11 The download file is named: Safari4.0.3Ti.dmg Its SHA-1 digest is: 9a5532516d3a74a2bd65cc007db683b85e3475d7 Safari for Windows XP or Vista The download file is named: SafariSetup.exe Its SHA-1 digest is: 24486c2a3089cf0b61b50e4a75ec5f53d9c08f4f Safari+QuickTime for Windows XP or Vista The file is named: SafariQuickTimeSetup.exe Its SHA-1 digest is: 61c0e163fef26c8580297d30e6c04af7a2548038 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKgbZ0AAoJEHkodeiKZIkBLWwIALn35RpygbXlkkNzwCt776Kf yPIRqfpe9K9hYwQwsV/5+Cu/Kcf9Jh72E3xRCtsSPFGSoqClK6VommAwtReBeaXR QXJj2OoxyX7IjestI5I2hL5ayUK+So78Pn3KQ8TdrJliak5Cba9Gh9DLye+23n8w d2Nb9MbOMz6O6ad9rpa7r/BVIRT32sJb7CZHGYQkvSy/kKILWMoEfeTagLcoo9SO a30uGIoUq9i/qZ7KpcobGfd9KOSLfftkpznL/0acvNgD4XGe3xXt6Gr8PS2RTXJe 6TWm5emYAHvnMOhcDtjsNi8cR7Yrtsoc6/T971AJ+hJRn6I713rXGUBnVrC1Qks= =RWfC -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-08-05-1 Security Update 2009-003 / Mac OS X v10.5.8
by Apple Product Security 05 Aug '09

05 Aug '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-08-05-1 Security Update 2009-003 / Mac OS X v10.5.8 Security Update 2009-003 / Mac OS X v10.5.8 is now available and addresses the following: bzip2 CVE-ID: CVE-2008-1372 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Decompressing maliciously crafted data may lead to an unexpected application termination Description: An out-of-bounds memory access exists in bzip2. Opening a maliciously crafted compressed file may lead to an unexpected application termination. This update addresses the issue by updating bzip2 to version 1.0.5. Further information is available via the bzip2 web site at http://bzip.org/ CFNetwork CVE-ID: CVE-2009-1723 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: A maliciously crafted website may control the displayed website URL in a certificate warning Description: When Safari reaches a website via a 302 redirection and a certificate warning is displayed, the warning will contain the original website URL instead of the current website URL. This may allow a maliciously crafted website that is reached via an open redirector on a user-trusted website to control the displayed website URL in a certificate warning. This issue was addressed by returning the correct URL in the underlying CFNetwork layer. This issue does not affect systems prior to Mac OS X v10.5. Credit to Kevin Day of Your.Org, and Jason Mueller of Indiana University for reporting this issue. ColorSync CVE-ID: CVE-2009-1726 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Viewing a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in the handling of images with an embedded ColorSync profile. Opening a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of ColorSync profiles. Credit to Chris Evans of the Google Security Team for reporting this issue. CoreTypes CVE-ID: CVE-2009-1727 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Users are not warned before opening certain potentially unsafe content types Description: This update extends the system's list of content types that will be flagged as potentially unsafe under certain circumstances, such as when they are downloaded from a web page. While these content types are not automatically launched, if manually opened they could lead to the execution of a malicious JavaScript payload. This update improves the system's ability to notify users before handling content types used by Safari. Credit to Brian Mastenbrook, and Clint Ruoho of Laconic Security for reporting this issue. Dock CVE-ID: CVE-2009-0151 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: A person with physical access to a locked system may use four-finger Multi-Touch gestures Description: The screen saver does not block four-finger Multi-Touch gestures, which may allow a person with physical access to a locked system to manage applications or use Expose. This update addresses the issue by properly blocking Multi-Touch gestures when the screen saver is running. This issue only affects systems with a Multi-Touch trackpad. Image RAW CVE-ID: CVE-2009-1728 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Viewing a maliciously crafted Canon RAW image may lead to an unexpected application termination or arbitrary code execution Description: A stack buffer overflow exists in the handling of Canon RAW images. Viewing a maliciously crafted Canon RAW image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. For Mac OS X v10.4 systems, this issue is already addressed with Digital Camera RAW Compatibility Update 2.6. Credit to Chris Ries of Carnegie Mellon University Computing Services for reporting this issue. ImageIO CVE-ID: CVE-2009-1722 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Viewing a maliciously crafted OpenEXR image may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in ImageIO's handling of OpenEXR images. Viewing a maliciously crafted OpenEXR image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by updating OpenEXR to version 1.6.1. Credit to Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services for reporting this issue. ImageIO CVE-ID: CVE-2009-1721 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Viewing a maliciously crafted OpenEXR image may lead to an unexpected application termination or arbitrary code execution Description: An uninitialized memory access issue exists in ImageIO's handling of OpenEXR images. Viewing a maliciously crafted OpenEXR image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through proper memory initialization and additional validation of OpenEXR images. Credit: Apple. ImageIO CVE-ID: CVE-2009-1720 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Viewing a maliciously crafted OpenEXR image may lead to an unexpected application termination or arbitrary code execution Description: Multiple integer overflows exist in ImageIO's handling of OpenEXR images. Viewing a maliciously crafted OpenEXR image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issues through improved bounds checking. Credit: Apple. ImageIO CVE-ID: CVE-2009-2188 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in ImageIO's handling of EXIF metadata. Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. This issue does not affect systems prior to Mac OS X v10.5. ImageIO CVE-ID: CVE-2009-0040 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Processing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution Description: An uninitialized pointer issue exists in the handling of PNG images. Processing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of PNG images. Credit to Tavis Ormandy of the Google Security Team for reporting this issue. Kernel CVE-ID: CVE-2009-1235 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: A local user may obtain system privileges Description: An implementation issue exists in the kernel's handling of fcntl system calls. A local user may overwrite kernel memory and execute arbitrary code with system privileges. This update addresses the issue through improved handling of fcntl system calls. Credit to Razvan Musaloiu-E. of Johns Hopkins University, HiNRG for reporting this issue. launchd CVE-ID: CVE-2009-2190 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Opening many connections to an inetd-based launchd service may lead to a denial of service Description: Opening many connections to an inetd-based launchd service may cause launchd to stop servicing incoming connections to that service until the next system restart. This update addresses the issue through improved error handling. Login Window CVE-ID: CVE-2009-2191 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: A format string issue in Login Window may lead to an unexpected application termination or arbitrary code execution Description: A format string issue in Login Window's handling of application names may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of application names. Credit to Alfredo Pesoli of 0xcafebabe.it for reporting this issue. MobileMe CVE-ID: CVE-2009-2192 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Signing out of MobileMe does not remove all credentials Description: A logic issue exists in the MobileMe preference pane. Signing out of the preference pane does not delete all credentials. A person with access to the local user account may continue to access any other system associated with the MobileMe account which had previously been signed in for that local account. This update addresses the issue by deleting all the credentials on sign out. Networking CVE-ID: CVE-2009-2193 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Receiving a maliciously crafted AppleTalk response packet may lead to arbitrary code execution with system privileges or an unexpected system shutdown Description: A buffer overflow exists in the kernel's handling of AppleTalk response packets. Receiving a maliciously crafted AppleTalk response packet may lead to arbitrary code execution with system privileges or an unexpected system shutdown. This update addresses the issue through improved validation of AppleTalk response packets. Credit to Ilja van Sprundel from IOActive for reporting this issue. Networking CVE-ID: CVE-2009-2194 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: A local user may cause an unexpected system shutdown Description: A synchronization issue exists in the handling of file descriptor sharing over local sockets. By sending messages containing file descriptors to a socket with no receiver, a local user may cause an unexpected system shutdown. This update addresses the issue through improved handling of file descriptor sharing. Credit to Bennet Yee of Google Inc. for reporting this issue. XQuery CVE-ID: CVE-2008-0674 Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7 Impact: Processing maliciously crafted XML content may lead to arbitrary code execution Description: A buffer overflow exists in the handling of character classes in regular expressions in the Perl Compatible Regular Expressions (PCRE) library used by XQuery. This may allow a remote attacker to execute arbitrary code via a regular expression containing a character class with a large number of characters with Unicode code points greater than 255. This update addresses the issue by updating PCRE to version 7.6. Security Update 2009-003 / Mac OS X v10.5.8 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The Software Update utility will present the update that applies to your system configuration. Only one is needed, either Security Update 2009-003 or Mac OS X v10.5.8. For Mac OS X v10.5.7 The download file is named: MacOSXUpd10.5.8.dmg Its SHA-1 digest is: 11e79fb9b0ba63f211a708a1bcf8b397077a2e5e For Mac OS X v10.5 - v10.5.6 The download file is named: MacOSXUpdCombo10.5.8.dmg Its SHA-1 digest is: 6a3a744626503a807dd0158c41d0350aa37fe6c7 For Mac OS X Server v10.5.7 The download file is named: MacOSXServerUpd10.5.8.dmg Its SHA-1 digest is: dbcbe49662d818cfbe796f8bfb2bfe21c64dbc9e For Mac OS X Server v10.5 - v10.5.6 The download file is named: MacOSXServerUpdCombo10.5.8.dmg Its SHA-1 digest is: 5f23c8253193c59562b3d39acc7daf498902e59d For Mac OS X v10.4.11 (Intel) The download file is named: SecUpd2009-003Intel.dmg Its SHA-1 digest is: 49cff2d44c1f4bce1848aadadaaa22ac8807824f For Mac OS X v10.4.11 (PowerPC) The download file is named: SecUpd2009-003PPC.dmg Its SHA-1 digest is: 29d8b4678bdc592b672d091cce2e6e7ef3d43b28 For Mac OS X Server v10.4.11 (Universal) The download file is named: SecUpdSrvr2009-003Univ.dmg Its SHA-1 digest is: e1fc266df664ea495b3b5b4cb978aa7d705b8f92 For Mac OS X Server v10.4.11 (PowerPC) The download file is named: SecUpdSrvr2009-003PPC.dmg Its SHA-1 digest is: ba204cf8d09d4d2c7fd30573e67e47bfd8e5f2ab Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKedeJAAoJEHkodeiKZIkBN6MH/1CPnWDjLi2OMTNt0fLWKMsz LMXCXYFDijQwr/YFB3xSdvIilmy1NOryhEiPPTbBAYVLePx4y3kmkWjmMwk9rv2g XvDmY7xyjt9WwLj2ZbtO2GeAfIpBEkVQGYWgffdJ7YMDZpHGBA8YPKbZ9BCkbbEL OKvUfQB4q5NFP++cljrpY//L/s9SGCxWSV4hX7CxCoajVJu0ErhcVZ+NDdtvE2g3 t93liK50wVay0nWCFEbcBlgr7UhQamkmBn27o+VxTrDut+f+x9Wdv+bn/MjQObUq T2dpWgz8pRKgiR9Bbc5wfHCK8wjgCViB6zJ+59b5bin7lXbSHH30mUL+c/MFydE= =lWU5 -----END PGP SIGNATURE----- Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-08-03-1 GarageBand 5.1
by Apple Product Security 03 Aug '09

03 Aug '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-08-03-1 GarageBand 5.1 GarageBand 5.1 is now available and addresses the following: GarageBand CVE-ID: CVE-2009-2198 Available for: Mac OS X v10.5.7 Impact: A user's web activity may be tracked by third parties and advertisers Description: When GarageBand is opened, Safari's preferences are changed to always accept cookies. The default preference is to accept cookies only for the sites being visited. The altered setting may allow third parties and advertisers to track a user's web activity. This update addresses the issue by not changing the preference setting. Users who have run previous versions of GarageBand should confirm that their Safari preferences are set as desired. GarageBand 5.1 is available via the Apple Software Update application, or Apple's GarageBand download site at: http://support.apple.com/downloads/#garageband GarageBand for Mac OS X v10.5.7 The download file is named: GarageBand51.dmg Its SHA-1 digest is: 7c771583c826c8c70e5c5f01d925e28636d0364d Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKd2HkAAoJEHkodeiKZIkB7TAH/1MF2S1ySoIfJOCCtdKzZdJ0 ybQGdzJDls6v5o1pBIEbeCcRRR21nVFlI4Q0cyU2QVqeY9Wpsk+YD3SivW1BMxpK p0boHNfFdd2nbxH9tZ9DFsaoY3YIBIO7aJpc7GI3oK8iZ1XZic3z7QG0QcnIsLpg AB+nXLkOPEilfnF7JJU5ZT//NVSkrJcC/YleClP9Nuj9YgTUNxBCV09hYgU1I+ny Z4CJrha9v0OHK35+PzGnGbJUZ0YWs8mg1p+XWkrt19AyGC/tUdpuk4oALvmIE2HA v4puvcrUF6C5n9njz+3OtlL2yK9suo64AqYlEAVspglo44+mY/4X7O2cjPgcpPI= =RghO -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0