With its fifth security update for 2007, Apple patches 17 flaws
Apple today announced a new security update for users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9. The most serious of these vulnerabilities is for CoreGraphics in which an attacker could entice a user to open a specially crafted PDF file, resulting in an application crash and an overflow allowing the execution of malicious code. Other serious patches include those for Bind, Fetchmail, and GNU Screen. The update is available from within Mac OS X via the Software Update pane in System Preferences, or from Apple's Software Downloads.
Patch for Alias Manager
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0740. Successful exploitation could lead to installation of malicious programs.
Patch for BIND
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9, and addresses the vulnerabilities detailed in CVE-2007-0493, CVE-2007-0494, CVE-2006-4095, and CVE-2006-4096. Successful exploitation could lead to remote denial of service.
Patch for CoreGraphics
This patch affects users of Mac OS X v10.4.9 and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0751. Opening a maliciously crafted PDF file may crash an application or allow malicious code execution or allow malicious code execution.
Patch for crontabs
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0740. Successful exploitation could lead to remote denial of service.
Patch for Fetchmail
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-1558. Successful exploitation disclose fetchmail passwords.
Patch for file
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-1536. Successful exploitation may crash an application or allow malicious code execution or allow malicious code execution.
Patch for iChat
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-2390. Successful exploitation lead to installation of malicious programs.
Patch for mDNSResponder
This patch affects users of Mac OS X v10.4.9 and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-2386. Successful exploitation may lead to a denial of service or arbitrary code execution.could
Patch for PPP
This patch affects users of Mac OS X v10.4.9 and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0752. Successful exploitation could lead to privilege escalation.
Patch for ruby
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerabilities detailed in CVE-2006-5467 and CVE-2006-6303. Successful exploitation could lead to denial of service.
Patch for GNU Screen
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2006-4573. Successful exploitation could lead to multiple denial of service in GNU Screen.
Patch for texinfo
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2005-3011. Successful exploitation may cause another user running texinfo to overwrite arbitrary files.
Patch for VPN
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0753. Successful exploitation could lead to privilege escalation.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 







filling minor flaws BEFORE there is a problem, that somehow makes Macs more
or just as vulnerable as PCs? PCs have an active population of over 100,000
viruses that compromise Windows while there are currently 0 that affect Mac OS
X in the wild (public). But if it makes you feel better to think they are parallel,
keep telling yourself that.
company that fixes them BEFORE they become problems.
- hardly news, is it?
- by steviesteveo May 25, 2007 12:33 AM PDT
- I thought this site was for cool new hardware and stuff?
- Like this Reply to this comment
-
(5 Comments)This is positively mundane, I can check cnet for indepth analysis of a patch.