Apple patches Safari a second time
633142
(InfoWorld) - Apple Inc. Friday issued security updates to patch four vulnerabilities in Mac OS X and the Safari beta, marking the second time in eight days that the company has had to fix its newest browser, which runs on both Mac and Windows XP and Vista machines. The 2007-006 update for Mac OS X 10.3, "Panther" and 10.4 "Tiger," fixes a pair of problems in Safari -- the production-quality versions bundled with the operating system -- including a memory corruption vulnerability that could end with an attacker in control of the Mac. "Visiting a maliciously crafted Web page may lead to an unexpected application termination or arbitrary code execution," Apple said in its alert. The second bug, and to Apple, the less serious of the two, is a cross-site scripting flaw (XSS) in Safari that could be used by phishing sites to steal usernames and passwords. Apple Friday also updated the Safari beta, first released June 11, to version 3.0.2 for both Mac and Windows. Mac Safari 3.0.2 patches another XSS bug, while the Windows edition fixes that, plus a separate vulnerability that could let an attacker disguise the browser's address bar, perhaps as part of a spoofed site meant to trick users into divulging confidential information, such as bank account passwords. For Mac users, 2007-006 and the Safari update are mutually exclusive. If a Mac user has installed Safari Beta 3, only the Safari update will be offered; users who haven't bothered to try out the beta will see only the standard Mac OS X update. Windows users can update Safari to 3.0.2 by downloading the new version from Apple's site, or by running the optional Apple Software Update utility. The just-patched Safari bugs were credited to a team at Adobe Systems Inc., as well as to researchers at Westnet, an Australian Internet service provider, and Westpoint Ltd., a U.K.-based security company. None were accredited to Dave Maynor, one of several researchers who dug up vulnerabilities within a few hours of Safari 3.0's launch last week. Maynor, who said he had found half-a-dozen bugs straight away, refuses to disclose his findings to Apple, part of a year-long feud that goes back to a wireless hack demo Maynor and another researcher gave at last August's Black Hat security conference. "Due to the cries of 'it doesn't count, it's beta,' we are waiting to release any further information till the browser is released in a final state," Maynor said in an e-mail earlier this week.
425056
p2pnet.net News:- Apple Computer has issued a patch for 15 Mac OS X security flaws. But, &quot;It ain&#39;t us - it&#39;s them!&quot; - it&#39;s saying of some of the problems, &#39;them&#39; being certain open source components.
384670
For the second time this month and the fourth time this year, Apple Inc. has patched its QuickTime media player to close critical holes. Tuesday's patch addressed two bugs.
390182
Apple said today that it would make its Safari Web browser available for Windows-based PCs, opening a new front in its rivalry with Microsoft.
56222
Hot Fuzz Security hunters have discovered numerous bugs in a Windows version of Safari, hours after Apple released a beta version of the browser into the wild.â¦
548437
Computer users can be forgiven for yawning at Apple's recent decision to bring its Safari Web browser to machines running Microsoft Windows.
369010
(InfoWorld) - Mozilla patched its flagship Firefox browser Thursday with fixes for six vulnerabilities, one of which was stamped "critical" by the open-source developer. This was the third time Mozilla has updated Firefox in 2007. The updates bring the current browser to Version 2.0.0.4 and the 2005 edition to 1.5.0.12. MFSA 2007-12, the most serious of the six, patched 30 separate memory corruption bugs in the browser layout and JavaScript engines. Even Mozilla seemed unsure of their impact. "Some of these crashes showed evidence of memory corruption under certain circumstances, and we presume that with enough effort, at least some of these could be exploited to run arbitrary code," the advisory read. Mozilla warned Thunderbird and SeaMonkey that their e-mail software, which shares Firefox's layout engine, may be vulnerable to these bugs as well. The developers recommend that users do not enable JavaScript in Thunderbird or the mail portion of SeaMonkey. The updates also fix a pop-up bug that could be used to mask parts of the browser, such as the address bar; a cross-site scripting vulnerability; a problem with how the browsers handle cookies; and a flaw that could let attackers crash Firefox using its autocomplete feature. Firefox 2.0.0.4 can be downloaded from the Mozilla Web site for Windows, Mac OS X, and Linux; Firefox 1.5.0.12, meanwhile, is available from a different page. Current users can also update using the Check for Updates command in the help menu. Mozilla also reiterated that Thursday's patches would be Firefox 1.5's last and said that an update to Firefox 2.0.0.4 would be offered to its users "over the coming weeks." Although Firefox ended 2006 on an upbeat security note according to Symantec -- the anti-virus vendor tallied 40 patches in the last six months of the year, 26 percent fewer than the 54 released for rival browser Internet Explorer -- so far this year, Mozilla has addressed more than twice as many vulnerabilities as IE. In the first five months of 2007, 22 bugs in Firefox have been patched, nine of which were pegged as critical. Microsoft has fixed only eight in IE; seven were labeled critical.
746920
Apple Inc. launched a version of its Safari Web browser for Windows-based PCs on Monday, adding yet another tentacle to its multi-pronged encroachment of Microsoft Corp.'s turf.
148458
International issues bugging users Apple's Windows version of its Safari web browser is creating havoc on localised versions of Windows.â¦
91524
SUCH an embarrassment of riches. Apple Macintosh users have two new web browsers to choose from. It&#39;s a curious market. All Macs come with two free browsers: Microsoft&#39;s Internet Explorer 5.2, and Apple&#39;s own slick and elegant Safari.
757260
(InfoWorld) - Apple on Thursday unveiled the year's fifth major security update for Mac OS X to patch 17 vulnerabilities, but fewer than one-third of them could lead to hackers injecting their own code into a compromised system. Thursday's release also marked the first time this year that an operating system security update from Apple did not patch a vulnerability disclosed by the January Month of Apple Bugs project. If Apple sorted bugs by a ranking system -- as do other vendors, including Microsoft Corp. -- most of the bugs fixed by Security Update 2007-005 would be rated less than critical. In eight out of the 17, for example, exploits could do no more damage than to generate a denial of service of, or crash, the affected component. Microsoft typically pegs such vulnerabilities as "important" rather than "critical." Only five of the patched vulnerabilities could result in an attacker executing his own code. Among the serious bugs is one in how Mac OS X 10.4, known as Tiger, handles PDF files. "By enticing a user to open a maliciously crafted PDF file, an attacker could trigger the overflow, which may lead to an unexpected application termination or arbitrary code execution," Apple's advisory said. Attacks sporting this strategy, although rare on Macs, are common threats faced by Windows users, who have had to learn -- sometimes unsuccessfully -- to be wary of unexpected file attachments. Another dangerous flaw fixed Thursday exists in the code that maps ports on home networks in iChat, Apple's instant messaging service and software. An attacker need only send a malformed packet to trigger a buffer overflow, which could then be used to add malicious code to the Mac. The hacker, however, must have access to the local network to exploit the bug. Other parts of Mac OS X that were patched Thursday include BIND (Berkeley Internet Name Domain), the de facto standard Domain Name System server software, which was patched against four vulnerabilities; the Ruby CGI library (two vulnerabilities); and Fetchmail (one vulnerability). Although Thursday's update pushed Apple's year-to-date patch total to over 100, there was a bright side: It included fixes for fewer flaws thanÂ last monthÂ (25) and the month before (45). The security update can be downloaded from theÂ Apple siteÂ or using Mac OS X's built-in update service.
681724
A testing firm says that Apple's Safari browser is faster than rival browsers from Microsoft and Mozilla.
502357
Meanwhile, a second unofficial fix is out as attacks on Internet Explorer users are reportedly increasing.
21234
Apple kept its rush of year-end security patches coming Monday, issuing a flurry of fixes for its Mac OS X operating system and the test version of its Safari browser.Monday&#39;s patches included a whopping 31 updates for the Apple operating system. The Mac OS X patches fix components ranging from the Address Book and iChat software to under-the-covers operating system components such as ColorSync, the IO Storage Family, and the Perl, Python and Ruby programming languages.Most of these flaws theoretically could be exploited by attackers to run unauthorized software on the Mac, although some of them had other security implications, such as allowing an attacker to gain access to sensitive information or download files to the computer without authorization.These updates are for the Mac OS X 10.4 and 10.5 operating systems, known as Tiger and Leopard, respectively.Apple also released a minor update to its Safari 3 beta code, which runs on Windows as well as Mac OS X, fixing a cross-site scripting security problem that affects Windows users.The patches come just days after&#160;Apple released a major update to its QuickTime media player and a Java security fix for the Mac OS X 10.4 operating system, code-named Tiger. The QuickTime flaw was particularly serious, as&#160;it had been exploited by online criminals since early December.With hackers and security researchers now paying more attention to Apple&#39;s products, the company&#39;s security team has been working overtime on bug fixes this year. Monday&#39;s patches were Apple&#39;s 35th and 36th security updates this year. In 2006, the company released just 22 sets of patches for its products.
46982
CUPERTINO, Calif., June 14  /PRNewswire-FirstCall/ -- Apple(R) today announced that more than 1 million copies of Safari(TM) for Windows were downloaded in the first 48 hours since the free public beta was made available on Monday.
242106
Blog: Apple's Web browser was downloaded 1 million times from the company's Web site in the 48 hours since Steve Jobs unveiled it.
353081
Blog: Recently patched browser from Apple springs another leak.