Feeds

Apple's fourth Leopard spits out 25 patches

Mac OS X 10.5.4 lands

Beginner's guide to SSL certificates

Apple has coughed up 25 security updates that come bundled with yesterday's release of Mac OS X 10.5.4.

The firm said its latest Leopard release addresses operating system and application performance issues and fixes a heap of security flaws.

The update affects operating system components that include CoreTypes, c++filt, Net-SNMP, Ruby, Tomcat, VPN, Alias Manager and Webkit.

Six of the vulnerabilities affect the Ruby programming language. Apple said: "Multiple memory corruption issues exist in Ruby's handling of strings and arrays, the most serious of which may lead to arbitrary code execution."

The company said the update fixes the bug “by performing additional validation of strings and arrays".

The Alias Manager patch only affects Mac OS X 10.4.11 and Mac OS X Server 10.4.11 and addresses a “memory corruption issue” that “exists in the handling of AFP volume mount information in an alias data structure. Resolving an alias containing maliciously crafted volume mount information may lead to an unexpected application termination or arbitrary code execution”, said Apple.

It reckoned the update fixes the issue by performing additional validation of alias data structures.

Apple’s update, which can be downloaded from the company’s website or through the Mac OS X software update control panel, resolves problems with saving and reopening Adobe Creative Suite 3 files on a remote server. RAW image support has also been added for several cameras and the update improves reliability for the L2TP VPN client.

In addition, the update also makes Apple’s wireless AirPort hardware more reliable with 5GHz 802.11n and 802.11a networks, and with a number of music apps. iCal syncing has been improved and the firm has issued several fixes for its calendar app.

Safari performance problems that occur when loading secure web pages and secure web pages with client certificates residing on a smart card have also been resolved.

The Webkit patch addresses a security flaw first exposed by James Urquhart who pointed out to Apple that "visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.”

It said that the update “addresses the issue through improved bounds checking”. The firm has updated the version of Safari for Mac OS X 10.5.4 to 3.1.2. That version of the Apple-flavoured web browser is also now available for Mac OS X 10.4.11 and Windows XP/Vista.

The updates are available from Apple here, or via Mac OS X's Software Update feature. ®

Beginner's guide to SSL certificates

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Entity Framework goes 'code first' as Microsoft pulls visual design tool
Visual Studio database diagramming's out the window
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.