Whether you use a Mac or a PC, be prepared to install a bumper crop of security patches on your machine in the near future.

On Thursday, both Apple and Microsoft warned of critical vulnerabilities in their flagship software products that could allow attackers to take control of users' machines. Updates fixing more than 40 flaws in both the Tiger and Leopard versions of Mac OS X are available immediately. Fixes for at least 11 vulnerabilities in a variety of Microsoft titles will be released Tuesday.

Bugs that sound particularly pernicious include the following:

• libxslt. Because of a heap buffer overflow, viewing a maliciously crafted HTML page may lead to an unexpected application termination or arbitrary code execution.

• PSNormalizer. A buffer overflow could allow a maliciously crafted PostScript file to cause an unexpected application termination or arbitrary code execution.

• Networking. A heap buffer overflow in the local IPC component of configd's EAPOLController plugin could allow a local user to obtain system privileges.

For its part, Microsoft said it would issue 11 updates to fix security bugs in Windows, Internet Explorer, Active Directory, Office, and Host Integration Server. Four of the updates - affecting IE, Excel, Active Directory, and Host Integration Server - are rated critical, a designation that means the vulnerabilities can allow the remote hijacking of a PC with little or no interaction from the user.

The updates will be released on Tuesday. Today's details were made available through Microsoft's Security Bulletin Advance Notification, which is released on the Thursday preceding the second Tuesday of every month. ®

Related stories

• Who's got more cash? Apple or Microsoft? (5 November 2008)
• Microsoft: Malware for Windows on the rise (3 November 2008)
• Updated Microsoft rushes out emergency Windows security fix (23 October 2008)
• Microsoft's Patch Tuesday plugs critical holes in IE, Office (15 October 2008)
• Opera update quietly fixes bug brace (10 October 2008)
• Apple releases bumper patch batch (16 September 2008)
• Microsoft delivers four critical updates (9 September 2008)
• MS preps four critical updates for September (5 September 2008)
• Apple preps patch for 'problematic 3G' iPhone? (15 August 2008)
• Bumper Patch Tuesday plugs multiple Office flaws (13 August 2008)
• Apple DNS patch doesn't patch Mac clients (1 August 2008)
• Apple drags its heels on iPhone security patches (4 July 2008)
• Apple's fourth Leopard spits out 25 patches (1 July 2008)
• Get 'em while they're hot: critical security fixes from Microsoft, Apple (10 June 2008)
• Apple unleashes monster patch batch on Mac faithful (19 March 2008)