Apple has released Safari 5.0.5 for Mac OS X Leopard (10.5.8) and Snow Leopard (10.6.5+) and Windows XP, Vista, and Windows 7. The update addresses an integer overflow issue when handling nodesets in maliciously crafted website which may lead to unexpected application termination or arbitrary code execution. The recent fraudulent Comodo SSL certificates security issue is addressed in Security Update 2011-002 for Mac OS X users and for Windows users, please apply the security update in Microsoft Knowledge Base Article 2524375.
Safari 5 can be downloaded from www.apple.com/safari/
Apple states following regarding the security content of Safari 5.0.5:
Safari 5.0.5
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.
CVE-ID
CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann working with TippingPoint's Zero Day Initiative
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.
CVE-ID
CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day Initiative, and Martin Barbella
Note:
Certificates Trust Policy
Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. For Mac OS X systems, this issue is addressed with Security Update 2011-002. For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375
See also:
Security Update 2011-002 released
UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.16) Gecko/20110319 AlexaToolbar/alxf-2.11 Firefox/3.6.16
