Apple Patches Two Security Holes in Safari 5.0.5

Apple released Safari 5.0.5 Thursday, an update that includes fixes for two security holes. One hole could have led to the bad guys taking over your Mac or PC, while the other only affects Safari on the Mac. There are no feature updates included in this patch.

Apple’s patch notes:

  • WebKit
    Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later
    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
    Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

    CVE-ID
    CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp Weinmann, and an anonymous researcher working with TippingPoint’s Zero Day Initiative
  • WebKit
    Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
    Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later
    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
    Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

    CVE-ID
    CVE-2011-1344 : Vupen Security working with TippingPoint’s Zero Day
    Initiative, and Martin Barbella

Note:

Certificate Trust Policy

Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the-middle attacker
to redirect connections and intercept user credentials or other sensitive information. Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. For Mac OS X systems, this issue is addressed with Security Update 2011-002. For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375

You can download the update through Software Update on Mac OS X or through the Apple Updater utility that comes with iTunes and Safari on Windows. You can also download the update as a standalone installer through Apple’s support site.