Mac OS X Update - 10.5.6

Iniciar mensagem reenviada:

Data: 15 de dezembro de 2008 22h1min0s GMT-02:00

Assunto: Mac OS X Update - 10.5.6

Responder A: NSArchitect <noreply@blogger.com>

Fonte: iAntiVirus Blog

Autor: NSArchitect <noreply@blogger.com>

Apple has released an update for OS X which addresses some performance and severe security issues. Please run a Software Update and grab it today!

Security Issues addressed

• Apple Type Services (ATS) server PDF embedded font handling issue (CVE-ID: CVE-2008-4236)
• Arbitrary code execution in BOM (CVE-ID: CVE-2008-4217)
• Heap buffer overflow in CoreGraphics' handling of color spaces (CVE-ID: CVE-2008-3623)
• Possible user credential disclosure in Safari (CVE-ID: CVE-2008-3170)
• Enhanced download validation capability, previously warnings were not displayed for all unsafe download content types, this allowed for arbitrary code/command execution (CVE-ID: CVE-2008-4234)
• Multiple vulnerabilities in the Adobe Flash player plugin (CVE-IDs: CVE-2008-4818, CVE-2008-4819, CVE-2008-4820, CVE-2008-4821, CVE-2008-4822, CVE-2008-4823, CVE-2008-4824)
• Local privilege escalation issue due to integer overflows in the kernel's i386_get_ldt and i386_get_ldt system calls (affects Intel based machines only) (CVE-ID: CVE-2008-4218)
  
• Infinite loop when an exception occurs in a program (or dylib) which resides on an NFS share (CVE-ID: CVE-2008-4219)
  
• Integer overflow in the LibSystem inet_net_pton function -> this could affect any program which uses that function (CVE-ID: CVE-2008-4220)
  
• Memory corruption issue in the strptime function of LibSystem (CVE-ID: CVE-2008-4221)
  
• Multiple integer overflows in the strfmon function of LibSystem (CVE-ID: CVE-2008-1391)
  
• Per host configuration in managed client system installs sometimes incorrectly identifies the system (CVE-ID: CVE-2008-4237)
• natd infinite loop due to a maliciously crafted TCP packet -> only affects systems with the Internet Sharing service enabled (CVE-ID: CVE-2008-4222)
  
• Authentication bypass in Podcast Producer (OS X server only) (CVE-ID: CVE-2008-4223)
• Input validation issue when handling malformed UDF volumes, ISO files. Opening a malformed volume may cause an unexpected syustem shutdown. (CVE-ID: CVE-2008-4224)

Information from Apple here .

Note: All CVE IDs will be linked to their respective pages once they become available.

Ler mais…