Avne Lite

Penetration testing specialists Core Security has publicly released information on a serious security vulnerability in Apple’s Mac OS X and criticized the computer maker for delaying the release of a patch. The vulnerability, which only affects Apple Mac OS X v10.5, could allow hackers to take complete control of a vulnerable machine via malicious PDF files. In an advisory, Core Security said Apple claims it already has a patch prepared for this issue but failed to release the fix despite several promises. Apple did not give any reasons for skipping the patch release. Full Story

Firefox Panorama lets people group tabs in a visual array in an attempt to bring some order to browser tab chaos. Mozilla released its fourth beta of Firefox 4 on Tuesday, bringing a new feature that addresses one of the biggest challenges in the new era of the browser: reclaiming control over the burgeoning number of tasks that now happen on the Web. Available for Windows, Mac, and Linux, Firefox 4 beta 4 introduces a feature now called Firefox Panorama. Today's browsers typically cram tabs in a strip along the top of the window, but Panorama provides a Mac OS X Expose-like interface that groups tabs into related bunches. Panorama presents an array of thumbnail images, each representing a tab. The thumbnails reside in rectangular boxes that constitute a group. Tabs can be moved from one group to another, and groups can be named and moved as well. The overall idea is to make it easier to switch from one tab to another, to group or regroup related tabs, and overall to see what'...

Apple has shipped a new Mac OS X security update to fix 13 documented vulnerabilities, some serious enough to expose users to remote code execution attacks. The patch includes fixes for security holes in several open-source components, including ClamAV and PHP. Here’s a quick look at the vulnerabilities and affected components. * CVE-2010-1808: A stack buffer overlow exists in Apple Type Services’ handling of embedded fonts. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution. * CVE-2010-1800: CFNetwork permits anonymous TLS/SSL connections. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. This issue does not affect the Mail application. This issue is addressed by disabling anonymous TLS/SSL connections. This issue does not affect systems prior to Mac OS X v10.6.3. Continue reading

Adobe has shipped a security bulletin with patches for two critical vulnerabilities in its PDF Reader and Acrobat software products. The flaws fixed in this out-of-cycle patch affects Adobe Reader 9.3.3 and earlier versions for Windows, Mac and UNIX; and Adobe Acrobat 9.3.3 and earlier versions for Windows and Mac. Adobe’s advisory spells out the severity: These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system. Full article; Zdnet