Feeds

Modest Apple update slices third-party bugs

Dirty dozen vulns pureed

Security for virtualized datacentres

Apple has pushed out a major security update designed to crush a dozen security bugs, some of which present a critical security risk on unpatched systems. Many of the fixes involve flaws in third-party applications bundled with Mac OS X, rather the flaws in the OS itself.

Patches released by Apple on Tuesday address a malware injection risk in the CoreAudio media player, Flash Player plug-in bugs and a similarly critical vulnerability involving Image Raw. The update also tackles a recently discovered OpenSSL renegotiation exploit. Security fixes for CUPS and Image IO make up the remainder of the patch batch.

Andrew Storms, director of security operations for network security firm nCircle, described the size of the update as smaller than usual. The patch batch of six updates tackles 12 vulnerabilities, compared to the 40 odd bugs normally squashed by the fruit-themed consumer tech giant during a security update cycle.

"Most of these updates are connected with third party software. For example, seven of the twelve CVEs are connected with the update for Adobe's flash player plug-in," Storms said. "The remainder of the bugs patched today are the usual file format parsing problems that we've seen a lot of in the past."

An advisory from Apple (here) provides full details of the runners and riders contained in the update batch. Apple - unlike Microsoft, Adobe and Oracle - issues patch batches as and when they are needed rather than on a regular pre-announced monthly or quarterly schedule.

Bi-monthly updates from Apple are about par. Typically these updates are applied in the background and applied painlessly after Mac fans reboot their systems. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.