site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2009-11-11-1 Safari 4.0.4 Safari 4.0.4 is now available and addresses the following: ColorSync CVE-ID: CVE-2009-2804 Available for: Windows 7, Vista, XP Impact: Viewing a maliciously crafted image with an embedded color profile may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow exists in the handling of images with an embedded color profile, which may lead to a heap buffer overflow. Opening a maliciously crafted image with an embedded color profile may lead to an unexpected application termination or arbitrary code execution. The isssue is addressed by performing additional validation of color profiles. This issue does not affect Mac OS X v10.6 systems. The issue has already been addressed in Security Update 2009-005 for Mac OS X 10.5.8 systems. Credit: Apple. libxml CVE-ID: CVE-2009-2414, CVE-2009-2416 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Windows 7, Vista, XP Impact: Parsing maliciously crafted XML content may lead to an unexpected application termination Description: Multiple use-after-free issues exist in libxml2, the most serious of which may lead to an unxexpected application termination. This update addresses the issues through improved memory handling. The issues have already been addressed in Mac OS X 10.6.2, and in Security Update 2009-006 for Mac OS X 10.5.8 systems. Safari CVE-ID: CVE-2009-2842 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.1 and v10.6.2, Mac OS X Server v10.6.1 and v10.6.2, Windows 7, Vista, XP Impact: Using shortcut menu options within a maliciously crafted website may lead to the disclosure of local information Description: An issue exists in Safari's handling of navigations initiated via the "Open Image in New Tab", "Open Image in New Window", or "Open Link in New Tab" shortcut menu options. Using these options within a maliciously crafted website could load a local HTML file, leading to the disclosure of sensitive information. The issue is addressed by disabling the listed shortcut menu options when the target of a link is a local file. WebKit CVE-ID: CVE-2009-2816 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.1 and v10.6.2, Mac OS X Server v10.6.1 and v10.6.2, Windows 7, Vista, XP Impact: Visiting a maliciously crafted website may result in unexpected actions on other websites Description: An issue exists in WebKit's implementation of Cross- Origin Resource Sharing. Before allowing a page from one origin to access a resource in another origin, WebKit sends a preflight request to the latter server for access to the resource. WebKit includes custom HTTP headers specified by the requesting page in the preflight request. This can facilitate cross-site request forgery. This issue is addressed by removing custom HTTP headers from preflight requests. Credit: Apple. WebKit CVE-ID: CVE-2009-3384 Available for: Windows 7, Vista, XP Impact: Accessing a maliciously crafted FTP server could result in an unexpected application termination, information disclosure, or arbitrary code execution Description: Multiple vulnerabilities exist in WebKit's handling of FTP directory listings. Accessing a maliciously crafted FTP server may lead to information disclosure, unexpected application termination, or execution of arbitrary code. This update addresses the issues through improved parsing of FTP directory listings. These issues do not affect Safari on Mac OS X systems. Credit to Michal Zalewski of Google Inc. for reporting these issues. WebKit CVE-ID: CVE-2009-2841 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.1 and v10.6.2, Mac OS X Server v10.6.1 and v10.6.2 Impact: Mail may load remote audio and video content when remote image loading is disabled Description: When WebKit encounters an HTML 5 Media Element pointing to an external resource, it does not issue a resource load callback to determine if the resource should be loaded. This may result in undesired requests to remote servers. As an example, the sender of an HTML-formatted email message could use this to determine that the message was read. This issue is addressed by generating resource load callbacks when WebKit encounters an HTML 5 Media Element. This issue does not affect Safari on Windows systems. Safari 4.0.4 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Mac OS X v10.6.1 and v10.6.2 The download file is named: Safari4.0.4SnowLeopard.dmg Its SHA-1 digest is: 445df542b183fa65fd9df1f7ff4c6af306e6c0b9 Safari for Mac OS X v10.5.7 The download file is named: Safari4.0.4Leopard.dmg Its SHA-1 digest is: 0aeb54208cdebcafb3206baf11d8649836273f33 Safari for Mac OS X v10.4.11 The download file is named: Safari4.0.4Tiger.dmg Its SHA-1 digest is: fb1755e32e9019e929474ef97ba4da219dee8b8f Safari for Windows 7, Vista or XP The download file is named: SafariSetup.exe Its SHA-1 digest is: 236cfb9556dd369d95c5b45ddce740b15f2cb267 Safari+QuickTime for Windows 7, Vista or XP The file is named: SafariQuickTimeSetup.exe Its SHA-1 digest is: d95d61f2f804576b5d31fc8f47ac310438bc44dc Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.2.1608 wsBVAwUBS2i563kodeiKZIkBAQiHhQgAsnphSvmj6BmG8mvn9AkKLb0SSyJBwkCZ Mvxan6WaQZ3va7o3HN0MmQI2LVnjHWtqARVZjG3eeDdesvu9hEBLATpzb8w1O9cP KtSk8IlCMPtxpun6qsotcnyhKXf2X97y9h5GHQqcUmxMATMoHGltFwN4FDvktlXn WeJ5UVuEs6vyIRrez6lueHHnGtG0SVm3wC5+NQ/yX0y0Tn09tulD0y4Iw9ahNOfS nehllWJflw+VtdoNhhUcwE4zBVSpwjFEAjyJfysI57jNnLLJWKJoN2Mfxa2+oew5 HMfAx9AFMGNOiBPRPJeky0r4GzrCwgKtM/lLMTrnfC47YdXdgMVrnw== =v7pe -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40lis... This email sent to site_archiver@lists.apple.com