Safari 5.0.5 released

Safari

Apple has released Safari 5.0.5 for Mac OS X Leopard (10.5.8) and Snow Leopard (10.6.5+) and Windows XP, Vista, and Windows 7. The update addresses an integer overflow issue when handling nodesets in maliciously crafted website which may lead to unexpected application termination or arbitrary code execution. The recent fraudulent Comodo SSL certificates security issue is addressed in Security Update 2011-002 for Mac OS X users and for Windows users, please apply the security update in Microsoft Knowledge Base Article 2524375.


Safari 5 can be downloaded from www.apple.com/safari/

Join our discussion -

Apple has released Safari 5.0.5 for Mac OS X Leopard (10.5.8) and Snow Leopard (10.6.5+) and Windows XP, Vista, and Windows 7. The update addresses an integer overflow issue when handling nodesets in maliciously crafted website which may lead to unexpected application termination or arbitrary code execution. The recent fraudulent Comodo SSL certificates security issue is addressed in Security Update 2011-002 for Mac OS X users and for Windows users, please apply the security update in Microsoft Knowledge Base Article 2524375.


Safari 5 can be downloaded from www.apple.com/safari/

Join our discussion - Safari 5.0.5 released at SillyDog701 Message Centre

advertisement:

Apple states following regarding the security content of Safari 5.0.5:

Safari 5.0.5
WebKit

Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

CVE-ID

CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann working with TippingPoint's Zero Day Initiative

WebKit

Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

CVE-ID

CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day Initiative, and Martin Barbella

Note:

Certificates Trust Policy

Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. For Mac OS X systems, this issue is addressed with Security Update 2011-002. For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375

See also:
Security Update 2011-002 released (MacCentre701)

Join our discussion - Safari 5.0.5 released at SillyDog701 Message Centre


Posted by Antony at April 15, 2011 1:22 AM

>> more MacCentre701 April 2011 reports.