TIFF posts - Security

November 10, 2008 3:13 PM PST

Apple released an update on Monday for iLife 8.0 and Aperture 2 running on Mac OS v10.4.9 through v10.4.11.

The update does not affect those running Mac OS X v10.5.5. The update affects system software components shared by all iLife '08 applications and, in most cases, the specific vulnerabilities could lead to application termination or arbitrary code execution. iLife Support 8.3.1 may be obtained from the Software Update pane in System Preferences or Apple's Software Downloads Web site.

ImageIO-1
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. This update addresses the security issue detailed within CVE-2008-2327 in which viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits itself for finding the vulnerability.

ImageIO-2
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. This update addresses the security issue detailed within CVE-2008-2332 in which viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. The difference from the previous advisory is that this one involves a memory corruption issue exits in the handling of TIFF images. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits Robert Swiecki of Google Security Team for finding the vulnerability.

ImageIO-3
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. The update addresses the vulnerabilities detailed within CVE-2008-3608 in which viewing a large, maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution. Specifically, a memory corruption issue exists in ImageIO's handling of embedded ICC profiles in JPEG images. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits itself for finding the vulnerability.

Topics:: Vulnerabilities and attacks,; News

Tags:: Apple,; iLife,; TIFF,; JPEG,; arbitrary code execution,; Mac OS X 10.5.5

Share:: Digg; Del.icio.us; Reddit; Facebook; Twitter

About Security

Online security is threatened by more than hacking and phishing attempts. Check here for the latest updates on software vulnerabilities, data leaks, and rapidly spreading viruses--and learn how to protect your systems.

Add this feed to your online news reader

Security topics

Most Discussed

Inside CNET News

Scroll Left Scroll Right

Deep Tech
Long-awaited Bibble 5 raw photo editor arrives
Bibble 5 Pro is out, bringing higher performance and a higher price to the raw-photo editing and cataloging software. Also new: selective editing.
Gallery
En route to GPS-based air traffic control (images)
Apple
Report: Apple event to be held January 26
Unnamed source tells Fox News that the company will hold a mobile-focused event in San Francisco on January 26, which could be the day its long-awaited tablet makes its debut.
Beyond Binary
Visual Studio launch delayed by 'a few weeks'
Microsoft says it's still working to resolve some performance issues related to the Visual Studio 2010 developer tool suite, which was slated for a March release.
Video
Deep-sea volcanic explosion--part 2 (video)
Digital Media
Online holiday sales hit $27 billion
E-commerce sales grow 5 percent for the holiday season, reaching $27 billion compared with $25.8 billion last year, says new ComScore report.
Video
Deep-sea volcanic explosion--part 1 (video)
Deep Tech
'Don't-be-evil' Google spurns no-evil software
One open-source software programmer's joke--'The Software shall be used for Good, not Evil'--is a serious matter at Google.
The Space Shot
Soyuz craft docks, boosts space station crew
A Russian Soyuz spacecraft docked with the International Space Station Tuesday after a smooth, automated approach, boosting the lab's crew back up to five.
Gallery
NASA trains WISE eye on the sky (photos)
Gadgettes, the blog
Gadgettes Podcast 168: The Web obviously-not-exclusive-at-all-anymore Episode
There are a LOT of great pre and post-show moments. So many, in fact, that I couldn't possibly fit them all into one episode. As a result, here's a second collection!
Green Tech
Green-tech venture investing cools off in 2009
Green tech is still attracting billions of dollars a year, but the amount of money has shrunk significantly as investors began to focus on start-ups with the most potential.