Feeds

Apple's fourth Leopard spits out 25 patches

Mac OS X 10.5.4 lands

Mobile application security vulnerability report

Apple has coughed up 25 security updates that come bundled with yesterday's release of Mac OS X 10.5.4.

The firm said its latest Leopard release addresses operating system and application performance issues and fixes a heap of security flaws.

The update affects operating system components that include CoreTypes, c++filt, Net-SNMP, Ruby, Tomcat, VPN, Alias Manager and Webkit.

Six of the vulnerabilities affect the Ruby programming language. Apple said: "Multiple memory corruption issues exist in Ruby's handling of strings and arrays, the most serious of which may lead to arbitrary code execution."

The company said the update fixes the bug “by performing additional validation of strings and arrays".

The Alias Manager patch only affects Mac OS X 10.4.11 and Mac OS X Server 10.4.11 and addresses a “memory corruption issue” that “exists in the handling of AFP volume mount information in an alias data structure. Resolving an alias containing maliciously crafted volume mount information may lead to an unexpected application termination or arbitrary code execution”, said Apple.

It reckoned the update fixes the issue by performing additional validation of alias data structures.

Apple’s update, which can be downloaded from the company’s website or through the Mac OS X software update control panel, resolves problems with saving and reopening Adobe Creative Suite 3 files on a remote server. RAW image support has also been added for several cameras and the update improves reliability for the L2TP VPN client.

In addition, the update also makes Apple’s wireless AirPort hardware more reliable with 5GHz 802.11n and 802.11a networks, and with a number of music apps. iCal syncing has been improved and the firm has issued several fixes for its calendar app.

Safari performance problems that occur when loading secure web pages and secure web pages with client certificates residing on a smart card have also been resolved.

The Webkit patch addresses a security flaw first exposed by James Urquhart who pointed out to Apple that "visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.”

It said that the update “addresses the issue through improved bounds checking”. The firm has updated the version of Safari for Mac OS X 10.5.4 to 3.1.2. That version of the Apple-flavoured web browser is also now available for Mac OS X 10.4.11 and Windows XP/Vista.

The updates are available from Apple here, or via Mac OS X's Software Update feature. ®

The Essential Guide to IT Transformation

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.