Tuesday, December 19, 2006, 01:00 pm PT (04:00 pm ET)
Apple security update patches QuickTime exploitApple Computer on Tuesday afternoon released a recommended security update for Mac OS X 10.4 Tiger users that patches a vulnerability discovered with the company's QuickTime for Java and Quartz Composer software items.
The release, labeled Security Update 2006-008, is available as a 1.5MB download for PowerPC-based Macs and 1.8MB Universal Binary for Intel-based Macs.
The single-fix release address a specific issue where visiting a malicious web site may lead to information disclosure.
"Java applets may use QuickTime for Java to obtain the images rendered on screen by embedded QuickTime objects and upload them to the originating web site," Apple explained. "When this facility is used in conjunction with Quartz Composer, it becomes possible to capture images that may contain local information."
The Cupertino, Calif.-based Mac maker said the update addresses the issue by disallowing Quartz Composer compositions in unsigned Java applets.
After applying the update, Quartz Composer compositions will continue to function locally, while applications and signed Java applets that utilize QuickTime and QuickTime for Java are unaffected.
Apple said the vulnerability does not affect systems prior to Mac OS X 10.4, nor does it affect the Windows platform.
On Topic: General
- Samsung asks New Yorkers to compare Apple's iPad Air to Galaxy Tab S in new ad
- Apple's mysterious 2-story structure at site of Sept. 9 event drives frenzy even further
- Apple announces Sept. 9 event for expected 'iPhone 6' & 'iWatch' unveiling: 'Wish we could say more'
- Apple wins patent for Steve Jobs-designed Fifth Ave glass cube
- LG and Samsung announce new smartwatches ahead of Apple's anticipated 'iWatch' reveal [u]