APPLE-SA-2010-05-18-1 Java for Mac OS X 10.6 Update 2

Apple has released an update to Java 1.6.0_17 for Mac OSX 10.6 server and client to address various vulnerabilities in MacOSX implementations. These include execution of malicious code outside the java sand box and handling of un-trusted java applets. Namely un-trusted applets can execute on the system with the privileges of the current user. The issues are addressed by improved bounds checking and limiting access of applet to com.sun.medialib.mlib.

This update does not require a restart but users need to quit their browser and should clear out their Java cache using the Java Preference Utility. 

APPLE-SA-2010-05-18-2 Java for Mac OS X 10.5 Update 7

Apple has released an update to Java 1.6.0_17 for Mac OSX 10.5 server and client to address various vulnerabilities. These include execution of malicious code outside the java sand box and handling of un-trusted java applets. Namely un-trusted applets can execute on the system with the privileges of the current user. The issues are addressed by improved bounds checking and limiting access of applet to com.sun.medialib.mlib.

This update does not require a restart but users need to quit their browser and should clear out their Java cache using the Java Preference Utility. 

Critical Windows Safari Flaw Currently Does Not Affect OSX

There is a critical flaw that is being reported in the Window's version of Safari that can be trigged by a invalid pointer function call. For the flaw to be affective POPUP blocker has to be disabled, currently Safari install with POPUP blocker enabled. In addition based on the code posted I was unable to cause either an application DOS or arbitary code execution. The affect cause a popup window to open with a large String ('AAA...'), you will not see the OK and Cancel button since they are at the very end of the long String. Hitting return will clear the window, our payload would not execute using the latest MacOSX OS and Safari.  

Comments from the proof of concept code indicates platform tested, os+local and credit tag.

• Bug discovered by Krystian Kloskowski
• Tested on: Apple Safari 4.0.5 / XP SP2 Polish
• Shellcode: Windows Execute Command (calc)//* Our version osx/x86/exec - 44 bytes (BLOCK BOX)
• Local: Yes
• Remote: Yes (POPUP must be enabled [Ctrl+Shift+K])

Opera Releases 10.53

Opera update 10.53 addresses vulnerability which is triggered by multiple asynchronous calls to a script that modifies document contents. This results in a references to un-initialized value, thus causing a crash and allowing for arbitrary or malicious code execution. Users should perform the update via the Opera Software Updater or download dirrectly from http://www.opera.com/browser/

Security issues in Adobe Photoshop CS4 11.0.0

Adobe has released update CS4 11.0.1 to address CVE-2010-1279 in Photoshop CS4 11.0.0. A vulnerability exist in which a malformed .TIFF that is opened in Photoshop CS4 can result in denial of service, application crash or arbitrary code execution. Users should apply this update since it is tagged as critical. 

http://www.adobe.com/support/downloads/detail.jsp?ftpID=4291