Apple on Friday released patches for a cross-site scripting (XSS) flaw in WebCore and a vulnerability in WebKit that allows arbitrary code execution — as well a third beta version of Safari for Windows.
In its third security advisory of the past week, Apple said that the WebCore flaw could be exploited to create a HTTP injection issue.
The patch fixes the flaw in Mac OS X and OS X Server versions 10.3.9 and 10.4.9 or later.
The flaw exists in the SMLHttpRequest function when serializing headers into a HTTP request, according to Apple's advisory.
Researcher Richard Moore of Westpoint Ltd., credited by Apple with discovering the flaw, said the vulnerability exists in Safari for OS X and Microsoft’s Windows operating systems.
Moore informed Apple of the flaw on June 14, according to an advisory from Westpoint.
The WebKit flaw, which can be exploited to run malicious code on a Mac, is caused by an invalid type conversion when rendering frame sets, according to Apple.
The Cupertino, Calif.-based technology giant credited Rhys Kidd of Westnet, an Australian internet service provider, with reporting the issue, which also exists in Mac OS X and OS X Server versions 10.3.9 and 10.4.9 and later.
Both flaws were ranked "highly critical" by Secunia because they can be exploited from remote locations.
FrSIRT ranked the vulnerabilities as "critical," according to an advisory released today.
On Thursday, Apple fixed security flaws in Apple TV, a network device that permits users to play computer content on a television, and in IPv6.
Safari Beta 3.0.2, also released Friday, contains the latest security fixes from Apple, according to the company’s website. It is the third beta version of the browser since its initial release earlier this month.
Apple released Safari Beta 3.0.1 for Windows last week after a number of critical vulnerabilities were found in the first few hours after the browser was released to the public.
Matt Watchinski, director of Sourcefire’s vulnerability research team, told SCMagazine.com today that despite the frequency of Apple’s patch releases in recent weeks, the company doesn’t have nearly as large a security operation as Microsoft.
"Apple has a lot of growing to do here before anyone starts to do any comparison between the business that Apple has and (that of) Microsoft," he said.
Get more IT security news. Click here for SC Magazine Blogs.
