Feeds

Microsoft, Apple trumpet bevy of critical vulns

Whether you're a Mac or a PC, you need patching

Protecting against web application threats using SSL

Whether you use a Mac or a PC, be prepared to install a bumper crop of security patches on your machine in the near future.

On Thursday, both Apple and Microsoft warned of critical vulnerabilities in their flagship software products that could allow attackers to take control of users' machines. Updates fixing more than 40 flaws in both the Tiger and Leopard versions of Mac OS X are available immediately. Fixes for at least 11 vulnerabilities in a variety of Microsoft titles will be released Tuesday.

The Mac bugs reside in a wide range of third-party components, including the Clam anti-virus, Common Unix Printing System, and Apache, PHP, and MySQL servers. Apple is also fixing some home-grown technologies, including Finder and launchpad.

Bugs that sound particularly pernicious include the following:

  • libxslt. Because of a heap buffer overflow, viewing a maliciously crafted HTML page may lead to an unexpected application termination or arbitrary code execution.
  • PSNormalizer. A buffer overflow could allow a maliciously crafted PostScript file to cause an unexpected application termination or arbitrary code execution.
  • Networking. A heap buffer overflow in the local IPC component of configd's EAPOLController plugin could allow a local user to obtain system privileges.

For its part, Microsoft said it would issue 11 updates to fix security bugs in Windows, Internet Explorer, Active Directory, Office, and Host Integration Server. Four of the updates - affecting IE, Excel, Active Directory, and Host Integration Server - are rated critical, a designation that means the vulnerabilities can allow the remote hijacking of a PC with little or no interaction from the user.

The updates will be released on Tuesday. Today's details were made available through Microsoft's Security Bulletin Advance Notification, which is released on the Thursday preceding the second Tuesday of every month. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.