Feeds

Apple fixes critical Mac holes triggered by image files

Attack of the killer PNGs

Internet Security Threat Report 2014

Apple on Wednesday patched 18 holes in its Mac OS X operating system, seven that could allow an attacker to remotely take over a machine when a user does nothing more than view a booby-trapped image.

The ImageIO Framework, which helps Mac applications read and write popular image formats, was responsible for five of the image vulnerabilities. A color management interface known as ColorSync and a component known as ImageRAW were to blame for the other two. The vulnerabilities create an ideal scenario for attackers, who could use specially manipulated PNG, OpenEXR and RAW files to remotely execute malicious code on the machines of oblivious users.

The flaws are the result of unitialized memory errors, unitialized pointer issues and heap, stack and integer overflows. Other patches fixed code-execution vulnerabilities in the OS X kernel, login window and other components in the OS.

At least one of the remote-execution vulnerabilities, contained in a component known as XQuery, involved buggy code that implements data based on the XML, or Extensible Markup Language, standard. Earlier Wednesday, security researchers in Finland warned of critical vulnerabilities in open-source XML Libraries that affect an enormous array of applications, but at time of writing it was unclear if the two were related.

The patches, which arrive as part of OS X 10.5.8, also fixed bugs in MobileMe. Apple has the rundown here. ®

Remote control for virtualized desktops

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.