Patch/Configuration Management, Vulnerability Management

Apple releases update to Safari to close seven holes

Apple has delivered an update to its Safari web browser.

Version 4.0.4, pushed out Wednesday, addresses seven vulnerabilities, including three in the WebKit, an engine that allows web browsers to render on web pages.

One of those WebKit flaws could be exploited if an attacker is able to access a maliciously crafted FTP server to cause arbitrary code execution. Meanwhile, another WebKit vulnerability can result in cross-site request forgery if a user visits a maliciously crafted web site.

The Safari update, which follows a major Mac OS X patch batch released earlier this week, also fixes a vulnerability in ColorSync, a graphics utility, that could permit code injection if a user views a malicious image with an embedded color profile.

The browser upgrade affects both Windows and Mac users. This is the sixth time Safari has been updated this year.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.