Apple fixes three iLife flaws

iLife Support 8.3.1 addresses three vulnerabilities affecting how the application processes TIFF and JPEG images.

Apple released an update on Monday for iLife 8.0 and Aperture 2 running on Mac OS v10.4.9 through v10.4.11.

The update does not affect those running Mac OS X v10.5.5. The update affects system software components shared by all iLife '08 applications and, in most cases, the specific vulnerabilities could lead to application termination or arbitrary code execution. iLife Support 8.3.1 may be obtained from the Software Update pane in System Preferences or Apple's Software Downloads Web site.

ImageIO-1
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. This update addresses the security issue detailed within CVE-2008-2327 in which viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits itself for finding the vulnerability.

ImageIO-2
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. This update addresses the security issue detailed within CVE-2008-2332 in which viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. The difference from the previous advisory is that this one involves a memory corruption issue exits in the handling of TIFF images. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits Robert Swiecki of Google Security Team for finding the vulnerability.

ImageIO-3
This patch affects users of iLife 8 or Aperture 2 running on Mac OS v10.4.9 through v10.4.11. The update addresses the vulnerabilities detailed within CVE-2008-3608 in which viewing a large, maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution. Specifically, a memory corruption issue exists in ImageIO's handling of embedded ICC profiles in JPEG images. The issue has already been addressed in systems running Mac OS X v10.5.5. Apple credits itself for finding the vulnerability.

Tags:
Security
About the author

    As CNET's former resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security.

     

    Join the discussion

    Conversation powered by Livefyre

    Don't Miss
    Hot Products
    Trending on CNET

    HOT ON CNET

    Looking for an affordable tablet?

    CNET rounds up high-quality tablets that won't break your wallet.