Security hole plugged in Skype for Mac

Flaw in how Net phone software handles Web links could enable an attacker to launch arbitrary code on some Macs.

Skype on Tuesday issued an update that fixes a serious security flaw in its Internet telephony software for Apple Computer's Mac OS X.

A vulnerability exists in the way Skype for Mac handles Web links, according to a Skype advisory. An attacker could construct a malformed Skype link which, when clicked on, can cause the application to crash or allow a system to be compromised.

"A user of Skype for Mac who follows a specially crafted URL may experience a crash of the Skype software and possibly may execute arbitrary code without consent," the company said in its advisory. The Net telephony provider, part of online auction giant eBay, deems the issue "high" risk.

A miscreant could publish a malformed Skype link on a Web site, for example, and try to trick someone into following it, the company said.

The vulnerability exists in Skype for Mac releases prior to and including 1.5.*.79. It has been fixed in release 1.5.*.80 or later, which was available for download on the Skype Web site on Tuesday.

Tags:
Security
About the author

    Joris Evers covers security.

     

    Discuss Security hole plugged in Skype for Mac

    Conversation powered by Livefyre

    Show Comments Hide Comments
    Latest Articles from CNET
    'Zoolander 2' trailer features, wait, Stephen Hawking?