2 - OS X Update 2009-001
The first security update from Apple for 2009. It fixes a huge number of issues (I counted 45 CVE numbers). Many of them are in X11, perl and python. This patch includes the Safari patch mentioned above.
3 - Java update for OS X
And lastly: Apple also released a patched version of java, which will bring Java up to version 8 for OS X 10.4 (Tiger… not Leopard). For Leopard (OS X 10.5), Java update 3 was released today as well.
See:
- http://support.apple.com/kb/HT1222
- http://support.apple.com/downloads/
OS X Security Update
- http://secunia.com/advisories/33937/
Release Date: 2009-02-13
Critical: Highly critical
Impact: Unknown, Security Bypass, Exposure of sensitive information, Privilege escalation, DoS, System access
Where: From remote
Solution Status: Vendor Patch …
Original Advisory: http://support.apple.com/kb/HT3438 …
Apple Airport Extreme / Time Capsule multiple vulns - updates available
- http://secunia.com/advisories/34105/2/
Release Date: 2009-03-06
Critical: Moderately critical
Impact: Spoofing, Exposure of sensitive information, DoS
Where: From remote
Solution Status: Vendor Patch
OS: Apple Airport Extreme, Apple Time Capsule …
Solution: Update to firmware version 7.4.1…
Original Advisory: HT3467: http://support.apple.com/kb/HT3467 …
QuickTime v7.6.2 released
- http://support.apple.com/kb/HT3591
June 01, 2009 - "This document describes the security content of QuickTime 7.6.2, which can be downloaded and installed via Software Update preferences, or from Apple Downloads*…"
* http://support.apple.com/downloads/
Safari jumbo patch - 50+ fixes…
- http://blogs.zdnet.com/security/?p=3541
June 8, 2009 - "… The latest fixes, available in the new Safari 4.0, corrects a wide range of code execution and denial-of-service vulnerabilities and even comes with a fix for the vexing “clickjacking” issues plaguing modern Web browsers… The latest Safari refresh also fixes five documented several code execution issues in CoreGraphics (all could lead to complete computer takeover attacks); an ImageIO issue that could be exploited via maliciously crafted PNG images; 5 flaws in libxml; and a variety of WebKit vulnerabilities that affect Safari on both Mac and Windows systems…"
- http://support.apple.com/downloads/Safari_4
- http://secunia.com/advisories/35379/2/
Release Date: 2009-06-09
Critical: Highly critical
Impact: Exposure of sensitive information, System access
Where: From remote
Solution Status: Unpatched
Software: Safari 3.x, Safari for Windows 3.x …
Solution: Upgrade to Safari version 4, which fixes the vulnerabilities…
- http://voices.washingtonpost.com/securityf…rss=securityfix
June 16, 2009 - "… This Java update appears to address most of the outstanding Java vulnerabilities. From looking at the common vulnerabilities and exposures (CVE) numbers attached to each of the flaws fixed by Apple's Java rollup, it looks like this update brings Mac OS X systems to the equivalent of Java 6 Update 13…"
- http://support.apple.com/downloads/
July 08, 2009 - 40MB ( Leopard) 26 MB (Tiger) 47MB (Windows)
"This update is recommended for all Safari users and improves the stability of the Nitro JavaScript engine and includes the latest compatibility and security fixes."
- http://secunia.com/advisories/35758/2/
Release Date: 2009-07-09
Critical: Highly critical
Impact: Cross Site Scripting, System access
Solution: Update to version 4.0.2.
- http://secunia.com/advisories/36096/2/
Release Date: 2009-08-06
Critical: Highly critical
Impact: Security Bypass, Spoofing, DoS, System access
Where: From remote
Solution Status: Vendor Patch
OS: Apple Macintosh OS X …
Solution: Update to Mac OS X v10.5.8 or apply Security Update 2009-003…
Apple Safari v4.0.3 released
- http://support.apple.com/downloads/
August 11, 2009 - "This update is recommended for all Safari users and includes improvements to stability, compatibility and security…"
- http://secunia.com/advisories/36269/2/
Release Date: 2009-08-12
Critical: Highly critical
Impact: Spoofing, Manipulation of data, Exposure of sensitive information, System access
Where: From remote
Solution Status: Vendor Patch
Software: Apple Safari 4.x
Solution: Update to version 4.0.3…
Original Advisory: Apple: http://support.apple.com/kb/HT3733
- http://secunia.com/advisories/36299/2/
Release Date: 2009-08-13
Critical: Moderately critical
Impact: DoS
Where: From remote
Solution Status: Vendor Patch
OS: Apple Macintosh OS X …
Solution: Apply Security Update 2009-004…
- http://voices.washingtonpost.com/securityf…ackdates_f.html
September 3, 2009 - "… The Java update brings Mac's version of Java to 10.5 Update 5, and fixes at least 16 security flaws in the program. Users can grab the patch through Software Update or directly from Apple Software Downloads. Mac users who have upgraded to Snow Leopard should be aware that the current version of the installation disc comes with an outdated version of Flash - version 10.0.23.1. Snow Leopard users can upgrade to the latest version - 10.0.32.18 - by visiting the Flash Player Download Center*."
* http://get.adobe.com/flashplayer/
- http://secunia.com/advisories/36598/2/
Release Date: 2009-09-04
Critical: Highly critical
Impact: Unknown, Security Bypass, Spoofing, Exposure of sensitive information, DoS, System access
Where: From remote
Solution Status: Vendor Patch
OS: Apple Macintosh OS X…
Solution: Apply Java for Mac OS X 10.5 Update 5…
- http://secunia.com/advisories/36627/2/
Last Update: 2009-09-11
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch
Software: Apple QuickTime 7.x
Solution: Update to version 7.6.4…
- http://secunia.com/advisories/36701/2/
Release Date: 2009-09-11
Critical: Highly critical
Impact: Security Bypass, Cross Site Scripting, Exposure of sensitive information, Privilege escalation, DoS, System access
Where: From remote
Solution Status: Vendor Patch
OS: Apple Macintosh OS X …
Solution: Update to Mac OS X v10.6.1 or apply Security Update 2009-005…
iTunes playlist vuln - update available
- http://www.securityfocus.com/brief/1015
2009-09-23 - "… a single flaw in the way that iTunes 9, the latest version of its popular multimedia management software, handles playlists on both the Mac OS X and Windows operating systems. The vulnerability could allow an attacker to create a specially-crafted playlist that compromises a victim's computer with malicious software… Cybercriminals have increasingly focused on attacking third-party applications…"
- http://secunia.com/advisories/36744/2/
Release Date: 2009-09-23
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch
Software: iTunes 9.x…
Solution: Update to version 9.0.1…
Original Advisory: http://support.apple.com/kb/HT3884
September 22, 2009
