Feeds

Apple's fourth Leopard spits out 25 patches

Mac OS X 10.5.4 lands

Protecting users from Firesheep and other Sidejacking attacks with SSL

Apple has coughed up 25 security updates that come bundled with yesterday's release of Mac OS X 10.5.4.

The firm said its latest Leopard release addresses operating system and application performance issues and fixes a heap of security flaws.

The update affects operating system components that include CoreTypes, c++filt, Net-SNMP, Ruby, Tomcat, VPN, Alias Manager and Webkit.

Six of the vulnerabilities affect the Ruby programming language. Apple said: "Multiple memory corruption issues exist in Ruby's handling of strings and arrays, the most serious of which may lead to arbitrary code execution."

The company said the update fixes the bug “by performing additional validation of strings and arrays".

The Alias Manager patch only affects Mac OS X 10.4.11 and Mac OS X Server 10.4.11 and addresses a “memory corruption issue” that “exists in the handling of AFP volume mount information in an alias data structure. Resolving an alias containing maliciously crafted volume mount information may lead to an unexpected application termination or arbitrary code execution”, said Apple.

It reckoned the update fixes the issue by performing additional validation of alias data structures.

Apple’s update, which can be downloaded from the company’s website or through the Mac OS X software update control panel, resolves problems with saving and reopening Adobe Creative Suite 3 files on a remote server. RAW image support has also been added for several cameras and the update improves reliability for the L2TP VPN client.

In addition, the update also makes Apple’s wireless AirPort hardware more reliable with 5GHz 802.11n and 802.11a networks, and with a number of music apps. iCal syncing has been improved and the firm has issued several fixes for its calendar app.

Safari performance problems that occur when loading secure web pages and secure web pages with client certificates residing on a smart card have also been resolved.

The Webkit patch addresses a security flaw first exposed by James Urquhart who pointed out to Apple that "visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.”

It said that the update “addresses the issue through improved bounds checking”. The firm has updated the version of Safari for Mac OS X 10.5.4 to 3.1.2. That version of the Apple-flavoured web browser is also now available for Mac OS X 10.4.11 and Windows XP/Vista.

The updates are available from Apple here, or via Mac OS X's Software Update feature. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
Not appy with your Chromebook? Well now it can run Android apps
Google offers beta of tricky OS-inside-OS tech
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
NHS grows a NoSQL backbone and rips out its Oracle Spine
Open source? In the government? Ha ha! What, wait ...?
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.