Mac OS X 10.5.7 finally arrives: dozens of security fixes

Stephen Withers
Wednesday, 13 May 2009 09:39

Opinion and Analysis

At least 18 of the issues relate to open source components used by Apple.

The Apple Type Services (ATS) issue is particularly interesting, as it is presumably the bug exploited by Charlie Miller to win the Pwn2Own contest at CanSecWest earlier this year, as he is not credited with reporting any other issues. The problem was that "Viewing or downloading a
document containing a maliciously crafted embedded CFF [Compact Font Format] font may lead to arbitrary code execution."

If this is the bug in question, then some of the criticism of Safari following Pwn2Own was misplaced.

The CoreGraphics bugs are also noteworthy, as they include multiple PDF issues, with at least one apparently similar to a recent Adobe Reader/Acrobat vulnerability. There were reports at the time that other vendors' PDF implementations were also vulnerable, and they have been borne out.

Some of the libxml, Safari and WebKit bugs have also been bundled into Safari 3.2.3 for Windows, Leopard and Tiger; and into the Safari 4 Beta Update for Mac OS X and Windows.

The updates are available via Software Update (Apple Software Update on Windows) or from Apple's Support Downloads page.

File sizes vary widely. The Mac OS X 10.5.7 update varies from 442M for the standalone updater to 951M for the combo updater for the server edition. Depending on the updates already installed, using Software Update may result in a smaller download.

Security Update 2009-002 for Tiger varies from 75M for the PowerPC updater to 203M for the Server Universal version.

Safari 3.2.3 is 40M for Leopard, 26M for Tiger, and 20M for Windows.