Yet another URL flaw for Safari 3.0 for Windows beta
285360
Blog: Researcher shows how URLs can be spoofed and content arbitrary within Safari 3.0 beta.
633142
(InfoWorld) - Apple Inc. Friday issued security updates to patch four vulnerabilities in Mac OS X and the Safari beta, marking the second time in eight days that the company has had to fix its newest browser, which runs on both Mac and Windows XP and Vista machines. The 2007-006 update for Mac OS X 10.3, "Panther" and 10.4 "Tiger," fixes a pair of problems in Safari -- the production-quality versions bundled with the operating system -- including a memory corruption vulnerability that could end with an attacker in control of the Mac. "Visiting a maliciously crafted Web page may lead to an unexpected application termination or arbitrary code execution," Apple said in its alert. The second bug, and to Apple, the less serious of the two, is a cross-site scripting flaw (XSS) in Safari that could be used by phishing sites to steal usernames and passwords. Apple Friday also updated the Safari beta, first released June 11, to version 3.0.2 for both Mac and Windows. Mac Safari 3.0.2 patches another XSS bug, while the Windows edition fixes that, plus a separate vulnerability that could let an attacker disguise the browser's address bar, perhaps as part of a spoofed site meant to trick users into divulging confidential information, such as bank account passwords. For Mac users, 2007-006 and the Safari update are mutually exclusive. If a Mac user has installed Safari Beta 3, only the Safari update will be offered; users who haven't bothered to try out the beta will see only the standard Mac OS X update. Windows users can update Safari to 3.0.2 by downloading the new version from Apple's site, or by running the optional Apple Software Update utility. The just-patched Safari bugs were credited to a team at Adobe Systems Inc., as well as to researchers at Westnet, an Australian Internet service provider, and Westpoint Ltd., a U.K.-based security company. None were accredited to Dave Maynor, one of several researchers who dug up vulnerabilities within a few hours of Safari 3.0's launch last week. Maynor, who said he had found half-a-dozen bugs straight away, refuses to disclose his findings to Apple, part of a year-long feud that goes back to a wireless hack demo Maynor and another researcher gave at last August's Black Hat security conference. "Due to the cries of 'it doesn't count, it's beta,' we are waiting to release any further information till the browser is released in a final state," Maynor said in an e-mail earlier this week.
353081
Blog: Recently patched browser from Apple springs another leak.
451531
Code that takes advantage of a Safari flaw could leave an iPhone open to attack.
474020
The latest beta of Mozilla's browser has been up and running for
127768
Third-party fix plugs a recently discovered browser flaw that's increasingly being exploited in cyberattacks.
663754
Microsoft has confirmed the existence of a vulnerability affecting the Windows Shell. The issue exists in the WebViewFolderIcon ActiveX control, and exploitation could result in an attacker gaining the same rights as a local user.
507071
Whats wrong with this picture?  All these URLs return HTTP 200 0K.  The only problem is that none of them actually exist and they're just HTML error pages.  Now whats wrong with this page?  This page has an RSS chicklet.  The problem is that it doesn't LINK to an RSS page.  It links to an HTML page which then *describes* the link to the RSS feed.  People click on the RSS link and subscribe to this and not the real RSS feed.  To add insult to industry *none* of these HTML pages have RSS autodiscovery.  This isn't funny.
213499
Update to "critical" Internet Explorer patch repairs a serious security flaw introduced by the original version.
56222
Hot Fuzz Security hunters have discovered numerous bugs in a Windows version of Safari, hours after Apple released a beta version of the browser into the wild.â¦
403071
Here's a screen shot of the HTML source.  Looks like it's trying to serve some kind of ActiveX control. Happy to be using a Mac.  PS: Scoble just showed up and TM works on his cell phone so there's something weird going on.
599698
A London security analyst working with the open source group GNUCitizen has discovered a potentially serious exploit that could affect users of the Firefox browser and Apple's QuickTime movie and music player - especially iTunes customers - on Windows XP-based machines. BetaNews tested and verified the severity of the exploit.
543022
Code that exploits a serious, yet-to-be-patched hole in Microsoft's Web browser has been posted on the Net.
63588
(InfoWorld) - Three days after releasing Safari 3.0, Apple has issued its first patch of the beta software. The 3.0.1 update, released early Thursday morning, fixes three flaws in the browser includingÂ bugs that were discovered earlier this weekÂ by researchers Thor Larholm and Aviv Raff. Apple released the 3.0 beta on Monday, and hackers started digging up bugs within hours. In fact, some researchers suggested that Apple should have done a better job of checking the browser for vulnerabilities before releasing the beta code. But even Apple's critics give the company credit for pushing out a quick update to its browser. "Let's give Apple a round of applause for the quick response," wrote researcher Tom Ferris on his blog Thursday. He says he's discovered 10 vulnerabilities in the browser. Earlier this week, Ferris said that Apple had done a "horrible" job of testing the Safari beta for bugs, prior to its initial release. Larholm agreed that the quick update was a good sign. "I want to congratulate Apple for fixing a serious security vulnerability in such a short time frame," he wrote in a blog posting. "Their usual response time can be counted in weeks to months." This is the first time that Apple has released a version of Safari for the Windows platform. Because it now can be run on a much larger number of systems, the code has been getting more attention from the security community.
666772
Apple continues to patch holes in its Safari for Windows, releasing version 3.0.2 of the browser. The update addresses security issues and contains several functionality tweaks.
584817
Will a trifecta try at fixing Internet Explorer patch be the charm?
204799
A new flaw has been discovered in Microsoft&#39;s Internet Explorer browser that allows malicious users to create fake sites that could lead to new email phishing scams.