Apple Fixes Security Holes, Updates Leopard

Where last week finished up with having to patch my Firefox browser with two handfuls of security patches, Apple has released its first batch of security updates for this year. And it's a biggie.I no more sat down at my system after dinner, and I'm greeted with a 180 MB update through the OS X Software Update feature. It's both an update to Leopard 10.5.2 and more than 10 security fixes.

The majority of the fixes apply to Leopard and Leopard Server.

The fixes include one aimed at the OS's Foundation and prevents a malicious Web URL from allowing renegade code to be launched, or crashing applications. Others include mending a gaffe in Parental Controls, Launch Services, NFS client and server vulnerabilities, as well as issues with X11 X Font Server.

While it's tough to tell which vulnerabilities are the most critical, because Apple doesn't rank its vulnerabilities as clearly as Microsoft, one of the worst vulnerabilities patched appears to be in its Mail client.

According to Apple's advisory, users who click on an especially crafted URL will be hit with code of the attacker's choice: "Affected users accessing a URL in a message may experience an arbitrary code execution. Apple says, "An implementation issue exists in Mail's handling of file:// URLs, which may allow arbitrary applications to be launched without warning when a user clicks a URL in a message. This issue does not affect systems running Mac OS X v10.5 or later."

And all of this fun on the eve of Microsoft's patch Tuesday. I'd better plan on spending some extra time in boot camp tomorrow.

More information from Apple on this evening's update is available here.