n'1fo[r-matik] » QuickTime http://www.n1fo.fr Pour les nymphos d'infos en info... Tue, 07 Feb 2012 22:31:27 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Apple Safari 4.0.4 http://www.n1fo.fr/2009/11/apple-safari-4-0-4/ http://www.n1fo.fr/2009/11/apple-safari-4-0-4/#comments Wed, 11 Nov 2009 22:45:52 +0000 1for-matik http://www.n1fo.fr/?p=390 Apple vient tout juste de publier une mise à jour pour son navigateur Safari. Mise à jour mineure qui corrige 6 failles de sécurité liés à ColorSync (1), libxml (1), Safari lui-même (1) et WebKit (3) et améliore les performances du navigateur. About Safari 4.0.4 This update is recommended for all Safari users and includes [...]]]>

Apple vient tout juste de publier une mise à jour pour son navigateur Safari. Mise à jour mineure qui corrige 6 failles de sécurité liés à ColorSync (1), libxml (1), Safari lui-même (1) et WebKit (3) et améliore les performances du navigateur.

About Safari 4.0.4

This update is recommended for all Safari users and includes improvements to performance, stability, and security including:

  • Improved JavaScript performance
  • Improved Full History Search performance for users with a large number of history items
  • Stability improvements for 3rd-party plug-ins, the search field and Yahoo! Mail

:dl: Télécharger Apple Safari 4.0.4 avec ou sans QuickTime

En ce qui concerne les failles, voici les infos :

Safari 4.0.4

  • ColorSyncCVE-ID: CVE-2009-2804Available for: Windows 7, Vista, XP

    Impact: Viewing a maliciously crafted image with an embedded color profile may lead to an unexpected application termination or arbitrary code execution

    Description: An integer overflow exists in the handling of images with an embedded color profile, which may lead to a heap buffer overflow. Opening a maliciously crafted image with an embedded color profile may lead to an unexpected application termination or arbitrary code execution. The issue is addressed by performing additional validation of color profiles. This issue does not affect Mac OS X v10.6 systems. The issue has already been addressed in Security Update 2009-005 for Mac OS X 10.5.8 systems. Credit: Apple.

  • libxmlCVE-ID: CVE-2009-2414, CVE-2009-2416Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Windows 7, Vista, XP

    Impact: Parsing maliciously crafted XML content may lead to an unexpected application termination

    Description: Multiple use-after-free issues exist in libxml2, the most serious of which may lead to an unexpected application termination. This update addresses the issues through improved memory handling. The issues have already been addressed in Mac OS X 10.6.2, and in Security Update 2009-006 for Mac OS X 10.5.8 systems.

  • SafariCVE-ID: CVE-2009-2842Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.1 and v10.6.2, Mac OS X Server v10.6.1 and v10.6.2, Windows 7, Vista, XP

    Impact: Using shortcut menu options within a maliciously crafted website may lead to the disclosure of local information

    Description: An issue exists in Safari’s handling of navigations initiated via the « Open Image in New Tab », « Open Image in New Window », or « Open Link in New Tab » shortcut menu options. Using these options within a maliciously crafted website could load a local HTML file, leading to the disclosure of sensitive information. The issue is addressed by disabling the listed shortcut menu options when the target of a link is a local file.

  • WebKitCVE-ID: CVE-2009-2816Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.1 and v10.6.2, Mac OS X Server v10.6.1 and v10.6.2, Windows 7, Vista, XP

    Impact: Visiting a maliciously crafted website may result in unexpected actions on other websites

    Description: An issue exists in WebKit’s implementation of Cross-Origin Resource Sharing. Before allowing a page from one origin to access a resource in another origin, WebKit sends a preflight request to the latter server for access to the resource. WebKit includes custom HTTP headers specified by the requesting page in the preflight request. This can facilitate cross-site request forgery. This issue is addressed by removing custom HTTP headers from preflight requests. Credit: Apple.

  • WebKitCVE-ID: CVE-2009-3384Available for: Windows 7, Vista, XP

    Impact: Accessing a maliciously crafted FTP server could result in an unexpected application termination, information disclosure, or arbitrary code execution

    Description: Multiple vulnerabilities exist in WebKit’s handling of FTP directory listings. Accessing a maliciously crafted FTP server may lead to information disclosure, unexpected application termination, or execution of arbitrary code. This update addresses the issues through improved parsing of FTP directory listings. These issues do not affect Safari on Mac OS X systems. Credit to Michal Zalewski of Google Inc. for reporting these issues.

  • WebKitCVE-ID: CVE-2009-2841Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.1 and v10.6.2, Mac OS X Server v10.6.1 and v10.6.2

    Impact: Mail may load remote audio and video content when remote image loading is disabled

    • Description: When WebKit encounters an HTML 5 Media Element pointing to an external resource, it does not issue a resource load callback to determine if the resource should be loaded. This may result in undesired requests to remote servers. As an example, the sender of an HTML-formatted email message could use this to determine that the message was read. This issue is addressed by generating resource load callbacks when WebKit encounters an HTML 5 Media Element. This issue does not affect Safari on Windows systems.

]]> http://www.n1fo.fr/2009/11/apple-safari-4-0-4/feed/ 0 Mozilla Firefox force la désactivation des extensions et plug-ins non sûrs http://www.n1fo.fr/2009/10/mozilla-firefox-force-desactivation-extensions-plug-ins-non-surs/ http://www.n1fo.fr/2009/10/mozilla-firefox-force-desactivation-extensions-plug-ins-non-surs/#comments Sun, 18 Oct 2009 13:22:11 +0000 1for-matik http://www.n1fo.fr/?p=368 Depuis quelques jours vous avez sûrement remarqué qu’une toute nouvelle fenêtre a fait son apparition sur Mozilla Firefox 3.5 et supérieur (oui la 3.6 bêta sort le 21 Octobre) : Ne vous inquiétez pas, c’est normal ! Cette fenêtre vous indique les extensions et plug-ins contenant des failles de sécurité qui n’ont pas été mis à jour [...]]]>

Depuis quelques jours vous avez sûrement remarqué qu’une toute nouvelle fenêtre a fait son apparition sur Mozilla Firefox 3.5 et supérieur (oui la 3.6 bêta sort le 21 Octobre) :

Ne vous inquiétez pas, c’est normal ! Cette fenêtre vous indique les extensions et plug-ins contenant des failles de sécurité qui n’ont pas été mis à jour et que, naturellement, Firefox désactive pour le bien de votre ordinateur.

Cette initiative est née depuis la sortie du .NET Frameworks 3.5 SP1 où lors de son installation, Microsoft forçait l’installation d’un plug-in pour Firefox sans le consentement de l’utilisateur. De plus, étant enregistrée dans la base de registre, l’utilisateur ne pouvait même pas désinstaller ce fameux plug-in.

Mais biensûr, cette fonction ne désactive pas que le plug-in de Microsoft, une liste est disponible à cette adresse et recense notamment les plug-ins de Deamon Tools ou d’AVG SafeSearch ou même de QuickTime !

]]> http://www.n1fo.fr/2009/10/mozilla-firefox-force-desactivation-extensions-plug-ins-non-surs/feed/ 1