iLife posts - Security

November 10, 2008 3:13 PM PST

Apple released an update on Monday for iLife 8.0 and Aperture 2 running on Mac OS v10.4.9 through v10.4.11.

The update does not affect those running Mac OS X v10.5.5. The update affects system software components shared by all iLife '08 applications and, in most cases, the specific vulnerabilities could lead to application termination or arbitrary code execution. iLife Support 8.3.1 may be obtained from the Software Update pane in System Preferences or Apple's Software Downloads Web site.

ImageIO-1
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. This update addresses the security issue detailed within CVE-2008-2327 in which viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits itself for finding the vulnerability.

ImageIO-2
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. This update addresses the security issue detailed within CVE-2008-2332 in which viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. The difference from the previous advisory is that this one involves a memory corruption issue exits in the handling of TIFF images. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits Robert Swiecki of Google Security Team for finding the vulnerability.

ImageIO-3
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. The update addresses the vulnerabilities detailed within CVE-2008-3608 in which viewing a large, maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution. Specifically, a memory corruption issue exists in ImageIO's handling of embedded ICC profiles in JPEG images. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits itself for finding the vulnerability.

Topics:: Vulnerabilities and attacks,; News

Tags:: Apple,; iLife,; TIFF,; JPEG,; arbitrary code execution,; Mac OS X 10.5.5

Share:: Digg; Del.icio.us; Reddit; Facebook; Twitter

About Security

Online security is threatened by more than hacking and phishing attempts. Check here for the latest updates on software vulnerabilities, data leaks, and rapidly spreading viruses--and learn how to protect your systems.

Add this feed to your online news reader

Security topics

Most Discussed

Inside CNET News

Scroll Left Scroll Right

Software, Interrupted
Open-source acquisitions: What's the holdup?
Acquisitions of open-source companies have garnered huge multiples but haven't rounded out many product portfolios. Exit plans are hazy for most open-source start-ups.
Gallery
Intel touts 3D, apps for Netbooks at CES (photos)
Technically Incorrect
Woman arrested after visiting with WoW teen
Canadian boy leaves home to see 42-year-old woman whom he met on World of Warcraft. No Canadian laws were broken, but she's arrested back home in Texas.
2010 CES
Ray Kurzweil tries to build a better e-reader
The computing pioneer is at CES showing off his Blio software that combines digital books with video, audio and Web content.
Video
Highlights from the Microsoft keynote
Media Maverick
Sarkozy's 'New Year's wish': Investigate Google
Not long after a list of pro-copyright proposals stirred controversy, France's president says he supports an investigation of Google as well as a tax on search engines.
Video
Floor-cleaning robot gets those tight spots
The Social
Pingdom: Facebook is killing it on page views
A report from the traffic firm suggests that the social network has 11 times as many page views as its closest competitor, MySpace.
Cutting Edge
Starry, starry 'first light' from NASA's WISE mission
The new Wide-field Infrared Survey Explorer kicks off its mission to scan and capture a view of the entire sky with a look at the constellation Carina.
Gallery
NASA trains WISE eye on the sky (photos)
2010 CES
Touching the LG Rumor Touch
We investigate the touch-screen version of the LG Rumor line of phones, the LG Rumor Touch. It has so many new features that it looks nothing like its predecessors.
2010 CES
Control4 readies networked home energy system
Control4's home energy management system uses a home wireless network and tough-screen display to monitor electricity and let consumers participate in energy efficiency programs.