VARIoT IoT vulnerabilities database

MySQL Manager in Apple Mac OS X 10.3.9 and 10.4.6, when setting up a new MySQL database server, does not use the "New MySQL root password" that is provided, which causes the MySQL root password to be blank and allows local users to gain full privileges to that database. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Buffer overflow in the FTP server (FTPServer) in Apple Mac OS X 10.3.9 and 10.4.6 allows remote authenticated users to execute arbitrary code via vectors related to "FTP server path name handling.". Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

CoreGraphics in Apple Mac OS X 10.4.6, when "Enable access for assistive devices" is on, allows an application to bypass restrictions for secure event input and read certain events from other applications in the same window session by using Quartz Event Services. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Integer underflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving conversions from string to file system representation within (1) CFStringGetFileSystemRepresentation or (2) getFileSystemRepresentation:maxLength:withPath in NSFileManager, and possibly other similar API functions. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via an enriched text e-mail message with "invalid color information" that causes Mail to allocate and initialize arbitrary classes. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Integer overflow in Mail in Apple Mac OS X 10.3.9 and 10.4.6 allows remote attackers to execute arbitrary code via a crafted MacMIME encapsulated attachment. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Finder in Apple Mac OS X 10.3.9 and 10.4.6 allows user-assisted attackers to execute arbitrary code by tricking a user into launching an Internet Location item that appears to use a safe URL scheme, but which actually has a different and more risky scheme. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

BOM in Apple Mac OS X 10.3.9 and 10.4.6 allows attackers to overwrite arbitrary files via an archive that contains symbolic links. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

NSSecureTextField in AppKit in Apple Mac OS X 10.4.6 does not re-enable secure event input under certain circumstances, which could allow other applications in the window session to monitor input characters and keyboard events. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Integer overflow in CFNetwork in Apple Mac OS X 10.4.6 allows remote attackers to execute arbitrary code via crafted chunked transfer encoding. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

The bundle API in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 loads dynamic libraries even if the client application has not directly requested it, which allows attackers to execute arbitrary code from an untrusted bundle. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

The WebTextRenderer(WebInternal) _CG_drawRun:style:geometry: function in Apple Safari 2.0.3 allows remote attackers to cause a denial of service (application crash) via an HTML LI tag with a large VALUE attribute (list item number), which triggers a null dereference in QPainter::drawText, probably due to a failed memory allocation that uses the VALUE. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. When parsing malformed .tiff graphic files, LZWDecodeVector(), _cg_TIFFSetField () or PredictorVSetField () functions do not correctly parse the malformed data, resulting in the failure to open the graphic Application crashes. The vulnerability is triggered by the core .tiff parsing engine, so Preview, Finder, QuickTime, and Safari are all possible attack vectors. 2 When decompressing a specially crafted .zip file, the BOMStackPop () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 4 When decompressing a specially crafted .bmp file, the ReadBMP () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 5 When decompressing a specially crafted .gif file, the CFAllocatorAllocate () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 1) An error exists in the "BOMStackPop()" function in the BOMArchiveHelper when decompressing malformed ZIP archives. 2) Some errors exists in the "KWQListIteratorImpl()", "drawText()", and "objc_msgSend_rtp()" functions in Safari when processing malformed HTML tags. 3) An error exists in the "ReadBMP()" function when processing malformed BMP images and can be exploited via e.g. Safari or the Preview application. 4) An error exists in the "CFAllocatorAllocate()" function when processing malformed GIF images and can be exploited via e.g. Safari when a user visits a malicious web site. 5) Two errors exists in the " _cg_TIFFSetField ()" and "PredictorVSetField()" functions when processing malformed TIFF images and can be exploited via e.g. The vulnerabilities have been reported in version 10.4.6. Other versions may also be affected. SOLUTION: Do not visit untrusted web sites, and do not open ZIP archives or images originating from untrusted sources. PROVIDED AND/OR DISCOVERED BY: Tom Ferris ORIGINAL ADVISORY: Tom Ferris: http://www.security-protocols.com/sp-x25-advisory.php http://www.security-protocols.com/sp-x26-advisory.php http://www.security-protocols.com/sp-x27-advisory.php http://www.security-protocols.com/sp-x28-advisory.php http://www.security-protocols.com/sp-x29-advisory.php http://www.security-protocols.com/sp-x30-advisory.php ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via a large CELLSPACING attribute in a TABLE tag, which triggers an error in KWQListIteratorImpl::KWQListIteratorImpl. Apple Safari There is a service disruption (DoS) There are vulnerabilities that are put into a state.Service disruption by a third party (DoS) There is a possibility of being put into a state. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. When parsing malformed .tiff graphic files, LZWDecodeVector(), _cg_TIFFSetField () or PredictorVSetField () functions do not correctly parse the malformed data, resulting in the failure to open the graphic Application crashes. The vulnerability is triggered by the core .tiff parsing engine, so Preview, Finder, QuickTime, and Safari are all possible attack vectors. 2 When decompressing a specially crafted .zip file, the BOMStackPop () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 4 When decompressing a specially crafted .bmp file, the ReadBMP () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 5 When decompressing a specially crafted .gif file, the CFAllocatorAllocate () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 1) An error exists in the "BOMStackPop()" function in the BOMArchiveHelper when decompressing malformed ZIP archives. 2) Some errors exists in the "KWQListIteratorImpl()", "drawText()", and "objc_msgSend_rtp()" functions in Safari when processing malformed HTML tags. 3) An error exists in the "ReadBMP()" function when processing malformed BMP images and can be exploited via e.g. Safari or the Preview application. 4) An error exists in the "CFAllocatorAllocate()" function when processing malformed GIF images and can be exploited via e.g. Safari when a user visits a malicious web site. 5) Two errors exists in the " _cg_TIFFSetField ()" and "PredictorVSetField()" functions when processing malformed TIFF images and can be exploited via e.g. The vulnerabilities have been reported in version 10.4.6. Other versions may also be affected. SOLUTION: Do not visit untrusted web sites, and do not open ZIP archives or images originating from untrusted sources. PROVIDED AND/OR DISCOVERED BY: Tom Ferris ORIGINAL ADVISORY: Tom Ferris: http://www.security-protocols.com/sp-x25-advisory.php http://www.security-protocols.com/sp-x26-advisory.php http://www.security-protocols.com/sp-x27-advisory.php http://www.security-protocols.com/sp-x28-advisory.php http://www.security-protocols.com/sp-x29-advisory.php http://www.security-protocols.com/sp-x30-advisory.php ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Stack-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file containing malformed font information. Multiple integer-overflow and buffer-overflow vulnerabilities affect QuickTime. Successful exploits will result in the execution of arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely cause denial-of-service conditions. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. Malformed font information may cause stack overflow, and malformed graphics data may cause heap overflow. An attacker could exploit these vulnerabilities by convincing a user to access a specially crafted image or media file with a vulnerable version of QuickTime. Since QuickTime configures most web browsers to handle QuickTime media files, an attacker could exploit these vulnerabilities using a web page. Disable QuickTime in your web browser An attacker may be able to exploit this vulnerability by persuading a user to access a specially crafted file with a web browser. Disabling QuickTime in your web browser will defend against this attack vector. For more information, refer to the Securing Your Web Browser document. Appendix A. ____________________________________________________________________ McAfee, Inc. McAfee Avert\x99 Labs Security Advisory Public Release Date: 2006-05-11 Apple QuickDraw/QuickTime Multiple Vulnerabilities CVE-2006-1249, CVE-2006-1453, CVE-2006-1454, CVE-2006-1459, CVE-2006-1460, CVE-2006-1461, CVE-2006-1462, CVE-2006-1464, CVE-2006-1465 ______________________________________________________________________ * Synopsis Apple QuickTime and Apple QuickDraw are multimedia technologies used to process image, audio and video data. Two code execution vulnerabilities are present in QuickDraw PICT image format support. Twenty one code execution vulnerabilities are present in QuickTime support for various multimedia formats including: MOV, H.264, MPEG 4, AVI, FPX and SWF. In order for an attack to succeed user interaction is required and therefore the risk factor for these issues is medium. CVE-2006-1459 Seven integer overflow vulnerabilities are present in QuickTime MOV video format support. CVE-2006-1460 Five buffer overflow vulnerabilities are present in QuickTime MOV video format support. CVE-2006-1461 Two buffer overflow vulnerabilities are present in QuickTime Flash (SWF) support. CVE-2006-1462 Three integer overflow vulnerabilities are presenting QuickTime H.264 (M4V) video format support. CVE-2006-1464 One buffer overflow vulnerability is present in QuickTime MPEG4 (M4P) video format support. CVE-2006-1465 One buffer overflow vulnerability is present in QuickTime AVI video format support. ______________________________________________________________________ * Legal Notice Copyright (C) 2006 McAfee, Inc. The information contained within this advisory is provided for the convenience of McAfee\x92s customers, and may be redistributed provided that no fee is charged for distribution and that the advisory is not modified in any way. McAfee makes no representations or warranties regarding the accuracy of the information referenced in this document, or the suitability of that information for your purposes. McAfee, Inc. and/or its affiliated companies in the United States and/or other Countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners. ______________________________________________________________________ . 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE----- . http://www.apple.com/support/downloads/quicktime71.html PROVIDED AND/OR DISCOVERED BY: 1) Reported by the vendor

Heap-based buffer overflow in Apple QuickTime before 7.1 allows remote attackers to execute arbitrary code via a crafted QuickDraw PICT image format file with malformed image data. Multiple integer-overflow and buffer-overflow vulnerabilities affect QuickTime. Successful exploits will result in the execution of arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely cause denial-of-service conditions. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. Malformed font information may cause stack overflow, and malformed graphics data may cause heap overflow. An attacker could exploit these vulnerabilities by convincing a user to access a specially crafted image or media file with a vulnerable version of QuickTime. Since QuickTime configures most web browsers to handle QuickTime media files, an attacker could exploit these vulnerabilities using a web page. Disable QuickTime in your web browser An attacker may be able to exploit this vulnerability by persuading a user to access a specially crafted file with a web browser. Disabling QuickTime in your web browser will defend against this attack vector. For more information, refer to the Securing Your Web Browser document. Appendix A. ____________________________________________________________________ McAfee, Inc. McAfee Avert\x99 Labs Security Advisory Public Release Date: 2006-05-11 Apple QuickDraw/QuickTime Multiple Vulnerabilities CVE-2006-1249, CVE-2006-1453, CVE-2006-1454, CVE-2006-1459, CVE-2006-1460, CVE-2006-1461, CVE-2006-1462, CVE-2006-1464, CVE-2006-1465 ______________________________________________________________________ * Synopsis Apple QuickTime and Apple QuickDraw are multimedia technologies used to process image, audio and video data. Twenty one code execution vulnerabilities are present in QuickTime support for various multimedia formats including: MOV, H.264, MPEG 4, AVI, FPX and SWF. In order for an attack to succeed user interaction is required and therefore the risk factor for these issues is medium. CVE-2006-1459 Seven integer overflow vulnerabilities are present in QuickTime MOV video format support. CVE-2006-1460 Five buffer overflow vulnerabilities are present in QuickTime MOV video format support. CVE-2006-1461 Two buffer overflow vulnerabilities are present in QuickTime Flash (SWF) support. CVE-2006-1462 Three integer overflow vulnerabilities are presenting QuickTime H.264 (M4V) video format support. CVE-2006-1464 One buffer overflow vulnerability is present in QuickTime MPEG4 (M4P) video format support. CVE-2006-1465 One buffer overflow vulnerability is present in QuickTime AVI video format support. ______________________________________________________________________ * Legal Notice Copyright (C) 2006 McAfee, Inc. The information contained within this advisory is provided for the convenience of McAfee\x92s customers, and may be redistributed provided that no fee is charged for distribution and that the advisory is not modified in any way. McAfee makes no representations or warranties regarding the accuracy of the information referenced in this document, or the suitability of that information for your purposes. McAfee, Inc. and/or its affiliated companies in the United States and/or other Countries. All other registered and unregistered trademarks in this document are the sole property of their respective owners. ______________________________________________________________________ . 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE----- . http://www.apple.com/support/downloads/quicktime71.html PROVIDED AND/OR DISCOVERED BY: 1) Reported by the vendor

Multiple heap-based buffer overflows in Mac OS X 10.4.6 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) PredictorVSetField function for TIFF or (2) CFAllocatorAllocate function for GIF, as used in applications that use ImageIO or AppKit. NOTE: the BMP vector has been re-assigned to CVE-2006-2238 because it affects a separate product family. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. When parsing malformed .tiff graphic files, LZWDecodeVector(), _cg_TIFFSetField () or PredictorVSetField () functions do not correctly parse the malformed data, resulting in the failure to open the graphic Application crashes. The vulnerability is triggered by the core .tiff parsing engine, so Preview, Finder, QuickTime, and Safari are all possible attack vectors. 2 When decompressing a specially crafted .zip file, the BOMStackPop () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 4 When decompressing a specially crafted .bmp file, the ReadBMP () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 5 When decompressing a specially crafted .gif file, the CFAllocatorAllocate () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 1) An error exists in the "BOMStackPop()" function in the BOMArchiveHelper when decompressing malformed ZIP archives. 2) Some errors exists in the "KWQListIteratorImpl()", "drawText()", and "objc_msgSend_rtp()" functions in Safari when processing malformed HTML tags. 3) An error exists in the "ReadBMP()" function when processing malformed BMP images and can be exploited via e.g. Safari or the Preview application. Safari when a user visits a malicious web site. The vulnerabilities have been reported in version 10.4.6. Other versions may also be affected. SOLUTION: Do not visit untrusted web sites, and do not open ZIP archives or images originating from untrusted sources. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attackers to execute arbitrary code via a crafted archive (such as ZIP) that contains long path names, which triggers an error in the BOMStackPop function. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. When parsing malformed .tiff graphic files, LZWDecodeVector(), _cg_TIFFSetField () or PredictorVSetField () functions do not correctly parse the malformed data, resulting in the failure to open the graphic Application crashes. The vulnerability is triggered by the core .tiff parsing engine, so Preview, Finder, QuickTime, and Safari are all possible attack vectors. 2 When decompressing a specially crafted .zip file, the BOMStackPop () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 4 When decompressing a specially crafted .bmp file, the ReadBMP () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 5 When decompressing a specially crafted .gif file, the CFAllocatorAllocate () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 1) An error exists in the "BOMStackPop()" function in the BOMArchiveHelper when decompressing malformed ZIP archives. 2) Some errors exists in the "KWQListIteratorImpl()", "drawText()", and "objc_msgSend_rtp()" functions in Safari when processing malformed HTML tags. 3) An error exists in the "ReadBMP()" function when processing malformed BMP images and can be exploited via e.g. Safari or the Preview application. Safari when a user visits a malicious web site. The vulnerabilities have been reported in version 10.4.6. Other versions may also be affected. SOLUTION: Do not visit untrusted web sites, and do not open ZIP archives or images originating from untrusted sources. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Heap-based buffer overflow in the LZWDecodeVector function in Mac OS X before 10.4.6, as used in applications that use ImageIO or AppKit, allows remote attackers to execute arbitrary code via crafted TIFF images. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. When parsing malformed .tiff graphic files, LZWDecodeVector(), _cg_TIFFSetField () or PredictorVSetField () functions do not correctly parse the malformed data, resulting in the failure to open the graphic Application crashes. The vulnerability is triggered by the core .tiff parsing engine, so Preview, Finder, QuickTime, and Safari are all possible attack vectors. 2 When decompressing a specially crafted .zip file, the BOMStackPop () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 4 When decompressing a specially crafted .bmp file, the ReadBMP () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 5 When decompressing a specially crafted .gif file, the CFAllocatorAllocate () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 1) An error exists in the "BOMStackPop()" function in the BOMArchiveHelper when decompressing malformed ZIP archives. 2) Some errors exists in the "KWQListIteratorImpl()", "drawText()", and "objc_msgSend_rtp()" functions in Safari when processing malformed HTML tags. 3) An error exists in the "ReadBMP()" function when processing malformed BMP images and can be exploited via e.g. Safari or the Preview application. Safari when a user visits a malicious web site. The vulnerabilities have been reported in version 10.4.6. Other versions may also be affected. SOLUTION: Do not visit untrusted web sites, and do not open ZIP archives or images originating from untrusted sources. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Unspecified vulnerability in the _cg_TIFFSetField function in Mac OS X 10.4.6 and earlier, as used in applications that use ImageIO or AppKit, allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers a null dereference. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. When parsing malformed .tiff graphic files, LZWDecodeVector(), _cg_TIFFSetField () or PredictorVSetField () functions do not correctly parse the malformed data, resulting in the failure to open the graphic Application crashes. The vulnerability is triggered by the core .tiff parsing engine, so Preview, Finder, QuickTime, and Safari are all possible attack vectors. 2 When decompressing a specially crafted .zip file, the BOMStackPop () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 4 When decompressing a specially crafted .bmp file, the ReadBMP () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 5 When decompressing a specially crafted .gif file, the CFAllocatorAllocate () function does not correctly parse the malformed data, resulting in a heap overflow vulnerability. 1) An error exists in the "BOMStackPop()" function in the BOMArchiveHelper when decompressing malformed ZIP archives. 2) Some errors exists in the "KWQListIteratorImpl()", "drawText()", and "objc_msgSend_rtp()" functions in Safari when processing malformed HTML tags. 3) An error exists in the "ReadBMP()" function when processing malformed BMP images and can be exploited via e.g. Safari or the Preview application. Safari when a user visits a malicious web site. The vulnerabilities have been reported in version 10.4.6. Other versions may also be affected. SOLUTION: Do not visit untrusted web sites, and do not open ZIP archives or images originating from untrusted sources. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----

Integer overflow in ImageIO in Apple Mac OS X 10.4 up to 10.4.5 allows remote attackers to cause a denial of service (crash) via a crafted JPEG image with malformed JPEG metadata, as demonstrated using Safari, aka "Deja-Doom". ImageIO is susceptible to a remote denial-of-service vulnerability. This issue is do to a failure to properly process malicious image files. This issue allows remote users to crash applications that use the ImageIO API, denying further service to users. Apple Mac OS X is reported prone to multiple security vulnerabilities. These issue affect Mac OS X in the following applications or modules: - AppKit - ImageIO - BOM - CFNetwork - ClamAV - CoreFoundation - CoreGraphics - Finder - FTPServer - Flash Player - ImageIO - Keychain - LaunchServices - libcurl - Mail - MySQL Manager - Preview - QuickDraw - QuickTime Streaming Server - Ruby - Safari A remote attacker may exploit these issues to execute arbitrary code, trigger a denial-of-service condition, gain access to potentially sensitive information, or overwrite files. Other attacks may also be possible. Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues. Appe QuickTime is a popular multimedia player that supports many media formats. Similar to using Safari. 1) An error in the AppKit framework allows an application to read characters entered into secure text field in the same window session. 2) Errors in the AppKit and ImageIO framework when processing GIF and TIFF images can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 3) A boundary error within the BOM component when expanding archives can be exploited to crash an application or potentially execute arbitrary code. For more information: SA19686 4) An input validation error in the BOM component when expanding archives can be exploited to cause files to be written to arbitrary locations outside the specified directory via directory traversal attacks. 5) An integer overflow error in the CFNetwork component when handling chunked transfer encoding may allow execution of arbitrary code if a user is tricked into visiting a malicious web site. 6) Errors in ClamAV when processing specially crafted email messages may allow execution of arbitrary code. For more information: SA19534 7) An error in the CoreFoundation component allows dynamic libraries to load and execute when a bundle is registered. This can be exploited to execute arbitrary code if an untrusted bundle is registered. 8) An integer underflow error within the "CFStringGetFileSystemRepresentation()" API during string conversion may allow execution of arbitrary code. 9) An error in the CoreGraphics component allows an application in the same window session to read characters entered into secure text field when "Enable access for assistive devices" is enabled. 10) An error in Finder within the handling of Internet Location items makes it possible to specify a different Internet Location type than the actual URL scheme used. This may allow execution of arbitrary code when launching an Internet Location item. 11) Boundary errors in the FTPServer component when handling path names can be exploited to malicious users to cause a buffer overflow, which may allow execution of arbitrary code. 12) Various errors in the Flash Player makes it possible to compromise a user's system via specially crafted Flash files. For more information: SA17430 SA19218 13) An integer overflow error in the ImageIO framework when processing JPEG images can be exploited to crash an application or potentially execute arbitrary code. 14) An error in the Keychain component allows an application to use Keychain items even when the Keychain is locked. This requires that the application has obtained a reference to a Keychain item before the Keychain was locked. 15) An error in the LaunchServices component when processing long filename extensions may allow bypassing of the Download Validation functionality. 16) Boundary errors in the libcurl URL handling may allow execution of arbitrary code. For more information: SA17907 17) An integer overflow error in the Mail component may allow execution of arbitrary code when viewing a specially crafted email message with MacMIME encapsulated attachments. 18) An error in the Mail component when handling invalid colour information in enriched text email messages may allow execution of arbitrary code. 19) An design error in MySQL Manager makes it possible to access the MySQL database with an empty password as the MySQL password supplying during initial setup is not used. 20) A boundary error in the Preview component may allow execution of arbitrary code via a stack-based buffer overflow when navigating a specially crafted directory hierarchy. 21) Two boundary errors in the QuickDraw component when processing of PICT images can be exploited to either cause a stack-based via a PICT image with specially crafted font information or a heap-based buffer overflow via a PICT image with specially crafted image data. This can be exploited to crash an application and potentially execute arbitrary code. 22) A NULL pointer dereference error in QuickTime Streaming Server when processing QuickTime movies with a missing track can be exploited to crash the application. 23) A boundary error in QuickTime Streaming Server when processing RTSP requests can be exploited to crash the application or potentially execute arbitrary code. 24) An error in Ruby can be exploited to bypass safe level restrictions. For more information: SA16904 25) An error in Safari when handling archives with symbolic links may place the symbolic links on a user's desktop. This requires that the "Open 'safe' files after downloading" option is enabled. SOLUTION: Apply Security Update 2006-003. 13) The vendor credits Brent Simmons, NewsGator Technologies. 14) The vendor credits Tobias Hahn, HU Berlin. 19) The vendor credits Ben Low, University of New South Wales. 21) The vendor credits Mike Price, McAfee AVERT Labs. 23) Mu Security research team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=303737 OTHER REFERENCES: SA19686: http://secunia.com/advisories/19686/ SA19534: http://secunia.com/advisories/19534/ SA17430: http://secunia.com/advisories/17430/ SA19218: http://secunia.com/advisories/19218/ SA17907: http://secunia.com/advisories/17907/ SA16904: http://secunia.com/advisories/16904/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Impacts of other vulnerabilities include bypassing security restrictions and denial of service. I. Further details are available in the individual Vulnerability Notes. II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service. III. This and other updates are available via Apple Update. Please see the Vulnerability Notes for individual reporter acknowledgements. ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-132A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-132A Feedback VU#519473" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History May 12, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRGTxnX0pj593lg50AQKebgf+PTa7qCt6QQRcXGlJ3vjPFOdO1VNRMGr8 WOP8JKHbCK93O3E6YtHJ3nQTJBfyq169TQijWvoWvjjXM603DojGXUXgTBZFhTSG c4L0jE2+nD3273nZXGPreFJAsPxK6me7d4Of/KQ/prJnUfrnWNxfrP90CmXRKNLD +4eC4BEjNXCqpb0ki62WQM7NED6IgfgNZWfO7faTSRYNRdEyLAgetQxZVm5eepyK BJO3rRBBRkOIkIIG5o/J5ViqgiuUP75N37QqTc7BtyzQR2OeWepytJvkMvJUBVAG r0fLUKvhT4wdHxsNGVGCxLNf3NHG1UuWNO3UZ9MeBmREdmeT+K0l9A== =cabu -----END PGP SIGNATURE-----