Apple Fixes Security Holes, Updates LeopardApple Fixes Security Holes, Updates Leopard
Where last week finished up with having to patch my Firefox browser with two handfuls of security patches, Apple has released its first batch of security updates for this year. And it's a biggie.
February 11, 2008
Where last week finished up with having to patch my Firefox browser with two handfuls of security patches, Apple has released its first batch of security updates for this year. And it's a biggie.I no more sat down at my system after dinner, and I'm greeted with a 180 MB update through the OS X Software Update feature. It's both an update to Leopard 10.5.2 and more than 10 security fixes.
The majority of the fixes apply to Leopard and Leopard Server.
The fixes include one aimed at the OS's Foundation and prevents a malicious Web URL from allowing renegade code to be launched, or crashing applications. Others include mending a gaffe in Parental Controls, Launch Services, NFS client and server vulnerabilities, as well as issues with X11 X Font Server.
While it's tough to tell which vulnerabilities are the most critical, because Apple doesn't rank its vulnerabilities as clearly as Microsoft, one of the worst vulnerabilities patched appears to be in its Mail client.
According to Apple's advisory, users who click on an especially crafted URL will be hit with code of the attacker's choice: "Affected users accessing a URL in a message may experience an arbitrary code execution. Apple says, "An implementation issue exists in Mail's handling of file:// URLs, which may allow arbitrary applications to be launched without warning when a user clicks a URL in a message. This issue does not affect systems running Mac OS X v10.5 or later."
And all of this fun on the eve of Microsoft's patch Tuesday. I'd better plan on spending some extra time in boot camp tomorrow.
More information from Apple on this evening's update is available here.
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
2022 Insurance Industry Cyber Threat Landscape Report
Protecting Critical Infrastructure: The 2021 Energy, Utilities, and Industrials Cyber Threat Landscape Report
Managed Security and the 3rd Party Cyber Risk Opportunity Whitepaper