X

With its fifth security update for 2007, Apple patches 17 flaws

The most serious involves poisoned PDF files. The update also includes patches for Bind, Fetchmail, and GNU Screen.

Robert Vamosi Former Editor
As CNET's former resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security.
Robert Vamosi
3 min read

Apple today announced a new security update for users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9. The most serious of these vulnerabilities is for CoreGraphics in which an attacker could entice a user to open a specially crafted PDF file, resulting in an application crash and an overflow allowing the execution of malicious code. Other serious patches include those for Bind, Fetchmail, and GNU Screen. The update is available from within Mac OS X via the Software Update pane in System Preferences, or from Apple's Software Downloads.

Patch for Alias Manager
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0740. Successful exploitation could lead to installation of malicious programs.

Patch for BIND
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9, and addresses the vulnerabilities detailed in CVE-2007-0493, CVE-2007-0494, CVE-2006-4095, and CVE-2006-4096. Successful exploitation could lead to remote denial of service.

Patch for CoreGraphics
This patch affects users of Mac OS X v10.4.9 and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0751. Opening a maliciously crafted PDF file may crash an application or allow malicious code execution or allow malicious code execution.

Patch for crontabs
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0740. Successful exploitation could lead to remote denial of service.

Patch for Fetchmail
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-1558. Successful exploitation disclose fetchmail passwords.

Patch for file
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-1536. Successful exploitation may crash an application or allow malicious code execution or allow malicious code execution.

Patch for iChat
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-2390. Successful exploitation lead to installation of malicious programs.

Patch for mDNSResponder
This patch affects users of Mac OS X v10.4.9 and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-2386. Successful exploitation may lead to a denial of service or arbitrary code execution.could

Patch for PPP
This patch affects users of Mac OS X v10.4.9 and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0752. Successful exploitation could lead to privilege escalation.

Patch for ruby
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerabilities detailed in CVE-2006-5467 and CVE-2006-6303. Successful exploitation could lead to denial of service.

Patch for GNU Screen
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2006-4573. Successful exploitation could lead to multiple denial of service in GNU Screen.

Patch for texinfo
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2005-3011. Successful exploitation may cause another user running texinfo to overwrite arbitrary files.

Patch for VPN
This patch affects users of Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, and Mac OS X Server v10.4.9, and addresses the vulnerability detailed in CVE-2007-0753. Successful exploitation could lead to privilege escalation.