Apple Security Update 2010-001

Apple has released Security Update 2010-001 to address various issues which have been reported recently including a fix of the TLS and SSL protocols, they do not allow renegotiation of sessions in this update. The IETF are still working on a fix to the protocol and the current version is a preventive security measure which mitigates the risk created. ImageIO has improved bounds checking which prevents a buffer overflow when viewing a maliciously crafted Tiff file. ImageRAW has been improved with better bound checking to address the handling of DNG images. 

CoreAudio could be exploited by a maliciously crafted mp4 file which would lead to application DOS or arbitrary code execution, there have been improvements to the bounds checking. CUPS was susceptible to a "use after free issue" in which an attacker could use a get-printer-jobs request to cause a DOS. It is recommended that users should unload the service if they are not using CUPS printing. This update has fixed this vulnerability but services that are not needed should be disabled. 

Apple also includes an updated Flash Player, after the install you should check your privacy and update settings in Flash to ensure the settings are what you want. This update requires a restart and is vital for client and server deployments.  

magmatic.com references

http://www.magmatic.com/currents/2009/11/7/tlsssl-vulnerability.html

http://www.magmatic.com/currents/category/flash