May 2010 - Security-announce

APPLE-SA-2010-05-18-2 Java for Mac OS X 10.5 Update 7
by Apple Product Security 18 May '10

18 May '10

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2010-05-18-2 Java for Mac OS X 10.5 Update 7 Java for Mac OS X 10.5 Update 7 is now available and addresses the following: Java CVE-ID: CVE-2009-3555, CVE-2009-3910, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849, CVE-2010-0886, CVE-2010-0887 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Multiple vulnerabilities in Java 1.6.0_17 Description: Multiple vulnerabilities exist in Java 1.6.0_17, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_20. Further information is available via the Sun Java website at http://java.sun.com/javase/6/webnotes/ReleaseNotes.html Java CVE-ID: CVE-2009-3555, CVE-2009-3910, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Multiple vulnerabilities in Java 1.5.0_22 Description: Multiple vulnerabilities exist in Java 1.5.0_22, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.5.0_24. Further information is available via the Sun Java website at http://java.sun.com/j2se/1.5.0/ReleaseNotes.html Java CVE-ID: CVE-2010-0538 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user Description: An out of bounds memory access issue exists in the handling of mediaLibImage objects. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user. This issue is addressed by preventing Java applets from using the com.sun.medialib.mlib package. This issue only affects the Mac OS X implementation of Java. Credit to Marc Schoenefeld of University of Bamberg for reporting this issue. Java CVE-ID: CVE-2010-0539 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user Description: A signedness issue exists in the handling of window drawing. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user. This issue is addressed through improved bounds checking. This issue only affects the Mac OS X implementation of Java. Credit to Jonathan Bringhurst of Northrop Grumman, and Jeffrey Czerniak for reporting this issue. Java for Mac OS X 10.5 Update 7 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The download file is named: JavaForMacOSX10.5Update7.dmg Its SHA-1 digest is: bd7835ed10bd8a3145c94a922c13e1704a65d374 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJL8tWtAAoJEGnF2JsdZQee1asH/R5/A6U67Ka8y8hJyKQuzpa1 QcB9Fxdpg8GFBRJ7GhtuL0jVb2IbNNA3OvqMYGdiXJ3Hsx3DxMtnXHG48MwClC0T KYq5I05cAZDRhnZQj/HGIV1BD9KmAD85TccLN1a1PHiwYrUMyVQaK7WK3chNhrYw 4PP7GEA5iNnHGVqYhQW2ZCpwv4DN1cWB/WofB/Yw4RSgTazhVm4WOj/q8wckckMR 9Pnd6AC0HyyQ+U3xaueOWuep/LEomYJ3+Yn6fEbuw5lrbuKJFiGwu+/RlnljjA0B Y59czbKu/ZqBgwl1t/ay1+kfpUDfE/Rzq/hMuHTZl8hZGm/u6qUkS/5u1tQUfjU= =1p5q -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2010-05-18-1 Java for Mac OS X 10.6 Update 2
by Apple Product Security 18 May '10

18 May '10

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2010-05-18-1 Java for Mac OS X 10.6 Update 2 Java for Mac OS X 10.6 Update 2 is now available and addresses the following: Java CVE-ID: CVE-2009-1105, CVE-2009-3555, CVE-2009-3910, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849, CVE-2010-0886, CVE-2010-0887 Available for: Mac OS X v10.6.3, Mac OS X Server v10.6.3 Impact: Multiple vulnerabilities in Java 1.6.0_17 Description: Multiple vulnerabilities exist in Java 1.6.0_17, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_20. Further information is available via the Sun Java website at http://java.sun.com/javase/6/webnotes/ReleaseNotes.html Java CVE-ID: CVE-2010-0538 Available for: Mac OS X v10.6.3, Mac OS X Server v10.6.3 Impact: Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user Description: An out of bounds memory access issue exists in the handling of mediaLibImage objects. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user. This issue is addressed by preventing Java applets from using the com.sun.medialib.mlib package. This issue only affects the Mac OS X implementation of Java. Credit to Marc Schoenefeld of University of Bamberg for reporting this issue. Java CVE-ID: CVE-2010-0539 Available for: Mac OS X v10.6.3, Mac OS X Server v10.6.3 Impact: Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user Description: A signedness issue exists in the handling of window drawing. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user. This issue is addressed through improved bounds checking. This issue only affects the Mac OS X implementation of Java. Credit to Jonathan Bringhurst of Northrop Grumman, and Jeffrey Czerniak for reporting this issue. Java for Mac OS X 10.6 Update 2 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The download file is named: JavaForMacOSX10.6Update2.dmg Its SHA-1 digest is: b369744000bac3077e884adea40de762f672094d Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJL8tWdAAoJEGnF2JsdZQeePZ8H/10UiP2NjnP1qXHwQ9GyktJ1 3x4ysed+G+Rf0Dar0PTU6tUCf2tAM0+dL59g1iCQZ/Xd+aF+HE3hqhcGniSbvdC+ PlkQMcC9bk6vrPOvoFvjRlNmUrRLaBeXJwQMrEr9tCbskErM6wl/E8fBTucRlUuE HSGugcZXpcGR/K7U+jIuAwpo+JIS8uXjyKb+kYlgfcjs27c+S3gpbaRj7YEPwHzx C99p2kzIkFu4Ap9C3uiZsroS5haJoqr6SIme/f9uBRked4wnh9RVVXH/FnEtQjCD WVKkDGlZIjYPKVQbOrxsl4UZ7CGjdeHscxuzbrpp7IHHAG78Ko09vsrjltNEg2s= =WJUH -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

Apple Product Security Key Renewal
by Apple Product Security 07 May '10

07 May '10

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 In accordance with established policy, we update the Apple Product Security PGP key every two years. Key information is available from our web site at: https://www.apple.com/support/security/pgp/ Here is our new PGP key which is effective immediately and valid until May 15, 2012: Key ID: 0x1D65079E Key Type: RSA Expires: 5/15/12 Key Size: 2048/2048 Fingerprint: FD32 51B9 4C0D 16A9 4DB7 99DE 69C5 D89B 1D65 079E UserID: Apple Product Security - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 9.7.2.1608 mQENBEviBuoBCADF4ELIH4hwoJ5G/Tq1t7lBkdRCKSsdn8SMmiFEOXR+uetjlJki eJWhhRzfkSfLGFOUuB5mbUNl+Q1unMb2+vIdJbHJmMK80BUWNYNANd/21l1ilpUH ptsWw7/qcHQQYkicvJSrmy1SlJeSOxOPMa8D3GuzKOOk0dcJ67RhOrHKJMIUMz2U gvgnyagBj79vuip29x//8oE4yuXnUFbtIfLMftVKMCOCalVFzqsZjunt4KAuuQ5o +xpHWf1diOGe+UgDQU/cCC8GBQJiFukd5EnrLREPj1+37klvxL+zXnFQu9n3xwjq phOMt2rW4V9aqoJ+1QZyd2P/TQjcJ9KEW0sdABEBAAG0M0FwcGxlIFByb2R1Y3Qg U2VjdXJpdHkgPHByb2R1Y3Qtc2VjdXJpdHlAYXBwbGUuY29tPokBFQMFEEviCB95 KHXoimSJAQECtZoIAKdBSD4spucNZtlhTlgpGQN/DX2e6ItRrrdha5cPiIyvi5Ma 8DBGA3MGjgIoTKewL8k2n5o3jwJtlfUnb8JERKQz/M+qooF3UbMNidwvb1t9rLIh ewWIKNUDHotRt38cCMn7O6thd7im5AfvBengIHXed59u1UWCZHXJ+xa7HOBapYe0 tGmQcODgSGcyvo7pIDuZTBEENOFj9R1NsGD4+qB18o2TVansiGF2Q4B8YTE5NJZz fpQyPrU5Um+nc0E5M2Z3qns7ukT6MuwYbOzg8dF87P+0f2kBCo32uIn+KCctAODS R9VJuTso8Ab4EdIf6f6AeCUvagpPFbLYwhcIqqqJAYoEEAECAHQFAkviCIsFCQPQ 54AwFIAAAAAAIAAHcHJlZmVycmVkLWVtYWlsLWVuY29kaW5nQHBncC5jb21wZ3Bt aW1lBAsJCAoCGQEZGGxkYXA6Ly9rZXlzZXJ2ZXIucGdwLmNvbQUbAwAAAAMWAgEF HgEAAAAEFQoICQAKCRBpxdibHWUHnsqDB/sEAymEY3QTqkSyb5Re/PkYWrvcCqps Syq2aE2ZZD5JtDc04fwiD6Kd1KPm7tvEK13wk7V3C6a1ymdbW4LjpsfngtWibZ7z EGp6c4RzB0S5qKv+dEISEkUh0Km5tHlySUqUxT+8xBGlYEKVkFIzNay6N5kgedRU qYuggriUJqn9EG2JFoUHWJ0hUm7QPr/yq8b9ue9aKxhJqUO3YJNT2dT0nZNugiFJ sHyqNxJ/PjNQB4CoCBM7R5amRz3Xc55rzz03kIcVs4vW1TVhUEAV2xBSHWtzZg6l wYv+WHae4uPP0f5vk6mvR01kHLuuuLbhewwyyKuyjURtl0xkejS22N/atE9BcHBs ZSBQcm9kdWN0IFNlY3VyaXR5IE5vdGlmaWNhdGlvbnMgPHByb2R1Y3Qtc2VjdXJp dHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20+iQGHBBABAgBxBQJL4giLBQkD0OeA MBSAAAAAACAAB3ByZWZlcnJlZC1lbWFpbC1lbmNvZGluZ0BwZ3AuY29tcGdwbWlt ZQQLCQgKGRhsZGFwOi8va2V5c2VydmVyLnBncC5jb20FGwMAAAADFgIBBR4BAAAA BBUKCAkACgkQacXYmx1lB55h7ggAncknDp8Tmm59mYCg5GggLQ/ScV9ruXKXnPNZ 6rO1upMnvmI+odwdg36kWMhDRMcdSJwgLL+i6nfqJtbeyfXTc4ZMDsc/miuF1ucn is3Xdcwb+M+08m9RxjNhZxHYVKIG5b8dxYkrq0M0UJ7XZNmCri/pEIw7D3UkVrH+ g8MY/47a12khL3Xr8R3a86S7eKTIjAWKLUHUC+2Q4V+7NE1ozbAdI1dlVv8UoGQD cDD1HG8ZmUnxsJr9s3kSOjZlYKaw0LVOgPgmFwC1UZepQBf9j5LMfssQmAZz278J 9Hk+zWsM/sDDQ0mYzBG1H13HD7S28fttU497/9/6Q+bEGYZa3rkBDQRL4gbrAQgA x8jQARpwNmIWcq0RTVKnLWAeAvc4z6dclbqvs4TimTid1l9NX3W9XeWBQ5ACiUnD o8F/clmIld7skd7zwVu9DB7o3T46hHmw2t9b6DeDzsagv8qMPiDkP9rMCQrxHH/E 4ucpnNLPcLT/5i/P1lqCfe99SXDWw3lP8WNhVhVBtKO3CBZH4vEGuVNCdE8iXaMW xYU0hwCvSB2Aud+Q8zB03UeNXOqUAtM9Fyz2cJvSoaQ+XR8bA8+Smnu2P7fSOPNG 1dp3cIikbvknEoXumjuNo0PNsvByhSQG1i1ICMKv5CMusEz1v6D6tu3EI3zGT3K6 Bay8Je8UXR/eiAYv9XMYtQARAQABiQJHBBgBAgExBQJL4gbsBQkD0OeABRsMAAAA wF0gBBkBCAAGBQJL4gbrAAoJEHQW/eFJFyBij4UIAKWitNPSewZMpylpXo6Iy/Iw CixoIs2hCZ8y3WVW8xWM/TZFyIoCGmIz/1zHQ072Zmfmj4K658Um/h8a8OTpKv/l Nxh+yvRmPlWMTFsWQ33VItoJUZBbF7Uz79S5atxARFhVWLf5b7IwAh8H+09B1dCF 645Sg2CML//lj6UtDeCpkjgM+7UPJSbD23Tst6S4HbXVIO86V/WmU5zQgP9mLMD9 YQjR6kismFTSx68aFM/W/VY1CWIQabULRmMAQ1KmY73w3YXG24k7RWtPV0yEuWXs u8cIfaPDFYhMfFiA1YHntnCbW87T15UjtTSN2G8T7gMWjl48EWgpUmqY9oBnvaAA CgkQacXYmx1lB56oHQf/ep5uqHq1szjpNWEaSx1brecWLzkdFkSNS35vLOmTpEf0 aQe8ySV6k6GcQ1nLXoIcaccmQ2oOsQBjZzRBjH9frza/M8MO2WCKtRxXGM9U3AjA EQkkzs6pNXrUoUT+OzTM2iq7Ph0qJ67WmcywEK4LqKjI6IpItiLdCrBrHJ0K6R08 wjp90uS0xaHircxhMaJ9MhYjwMtRzLgj2DsftnG9tn3yug294LtOMt9ZTzSttZSW zpofXH0815q0KCsBJM2HNQfxuvZ3mOwJ1HxfpmELXj9Z34axUdKsUJ8KchDCWMnf XU2oQ4PsqdA2kuVHxJWeMsfTi0mcjBlkR3Q6FLA18w== =zi3p - -----END PGP PUBLIC KEY BLOCK----- This message is signed with the current key. Archived keys are available via: https://www.apple.com/support/security/pgp/archive/ Apple Product Security team http://www.apple.com/support/security/ -----BEGIN PGP SIGNATURE----- Version: 9.7.2.1608 wsBVAwUBS+RNKXkodeiKZIkBAQgzbQgAjpZku2WqZtny5PLi4duuAxN8LcIlLqMC FwbY4leerXliPcWHVlNWCuOI56kQBaYnVb9kmbtiVxzin49as0TF4iXAze9JQA6h MyznW+htyfifs0DMelj8G/XXyYWylbgIF7DumVyx4rX8kaaR70mMVDtzR6pbkG2H oClHRJ2hJnIK5Wd9sNJKQoJJmU7aO5T4onIb1vAUkZFjLvp5zOrs1hwgi32lKIMQ C05mv+PO7dWqjDgk1/ujVY2ndeL1hqL8ZF/A5WvSlBJpzJWxC51POvlP08JMHxHV ld0A017qnPKo0dihAcEzICXz9WYEX+SOMmhWRQHC+GbE1bpEKS1u8g== =0sLl -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0