Newly issued Safari 5 closes dozens of holes

Safari 5, available for Windows and Mac, closes at least 48 holes. Additionally, Safari 4.1 was issued to address the same vulnerabilities for users of Mac OS X version 10.4 (Tiger), which is not supported by Safari 5.

The updates address vulnerabilities in Safari, as well as WebKit, an engine that allows web browsers to render on web pages, and Color Sync, a graphics utility.

One of the numerous Safari flaws could allow an attacker to obfuscate a maliciously crafted URL, making phishing attacks more effective, Apple said in its advisory. Additionally, due to a flaw in WebKit, dragging or pasting links or images from a maliciously crafted website could result in files being sent from the user's system to a remote server.

Many of the vulnerabilities could be exploited with no user interaction, according to researchers at Mac security vendor Intego.

“The wide variety of possible vulnerabilities ... is a sobering reminder that one of the main vectors of security threats today is the web,” a Tuesday blog post from Intego said. “Often the 'maliciously crafted websites' are hacked to include links that will exploit vulnerabilities; it's not even the user who has to go into the dark alleys of the internet to get hit."

Overall, the vulnerabilities could allow attackers to execute arbitrary code, cause a denial-of-service, obtain sensitive information, or conduct cross-site scripting attacks, according to an advisory issued Tuesday by US-CERT. Safari users are being advised to update to either Safari 5 or 4.1.

Safari 5 also includes a number of new, nonsecurity features including Safari Reader, which formats multipage online articles into a single page for easier viewing. Other new features include improved performance for faster web browsing, additional support for HTML5 features and a built-in Bing search engine bar.