Mac OS X 10.4.7アップデートがソフトウェア・アップデート経由で出ています。
下記はApple Product Securityからのメールの引用。
・「Apple releases Mac OS X 10.4.7 Update」AppleInsider
・「Apple releases Mac OS X 10.4.7 Update」macosXrumors
・「Mac OS X 10.4.7 Update Now Available」Mac Rumors
・「Apple releases Mac OS X 10.4.7」MacNN
・「Apple releases Mac OS X 10.4.7」Macworld
・「アップル、「Mac OS X 10.4.7」を公開--脆弱性の修正や機能アップデートを含む
・「Apple、Mac OS X 10.4.7をリリース」ITmedia News
Mac OS Xアップデート (PowerPC) 10.4.7 (39.8 MB)
すべての対象ユーザの方々に、10.4.7 アップデートの適用を推奨します。このアップデートには、オペレーティングシステムの全般的な修正のほか、次のようなアプリケーション、テクノロジーに関する修正が含まれています。このアップデートには以下の点についての修正が含まれています:
- AFP でのデッドロック、接続切れの防止
- AFP でマウントしたボリュームへの Adobe 書類や Quark 書類の保存
- Bluetooth ファイル転送、Bluetooth マウスの登録と接続、携帯電話との同期
- QuickTime、iTunes、Final Cut Pro、Soundtrack でのオーディオ再生
- デスクトップにアイコンが一定間隔で正しく表示されるように調整
- ディスク作成フォルダからのディスク作成に必要な空き容量の算定
- iChat でのオーディオ、ビデオの接続性、AIM 使用時のチャットルーム作成機能
- Keynote 3 へのファイル読み込み
- iCal、iPhoto 使用時の PDF ワークフロー
- Automator ワークフローでの各アクションの動作信頼性
- Font Book でのフォントの追加と取り除き
- アドレス、ブックマーク、カレンダーのイベント、ファイルなどの情報を.Mac と同期する機能
- 他社製アプリケーションやデバイスとの互換性
- 以前に、単体で実施されたセキュリティアップデート
このアップデートの詳細については、こちらを参照してください:http://www.info.apple.com/kbnum/n303771-ja
セキュリティアップデートの詳細については、こちらを参照してください:http://www.info.apple.com/kbnum/n61798-ja
下記はApple Product Securityからのメールの引用。
APPLE-SA-2006-06-27 Mac OS X v10.4.7
Mac OS X v10.4.7 is now available and addresses the following issues:
AFP
CVE-ID: CVE-2006-1468
Available for: Mac OS X v10.4 - v10.4.6, Mac OS X Server v10.4 - v10.4.6
Impact: File and folder names may be disclosed to unauthorized users
Description: An issue in AFP server allows search results to include the names of files and folders for which the user performing the search has no access. This could result in information disclosure if the names themselves are sensitive information. This update addresses the issue by ensuring that search results only include items for which the user is authorized. This issue does not affect systems prior to Mac OS X v10.4.
ClamAV
CVE-ID: CVE-2006-1989
Available for: Mac OS X Server v10.4 - v10.4.6
Impact: When virus scanning is configured to update automatically, a malicious database mirror may cause arbitrary code execution
Description: An issue in ClamAV's automatic virus database updating may result in a stack-based buffer overflow. A malicious or spoofed ClamAV database mirror may be able to cause arbitrary code execution with the privileges of ClamAV. The Mail service, virus scanning, and automatic virus database updates are off by default. This update addresses the issue by incorporating ClamAV 0.88.2. This issue does not affect systems prior to Mac OS X v10.4.
ImageIO
CVE-ID: CVE-2006-1469
Available for: Mac OS X v10.4 - v10.4.6, Mac OS X Server v10.4 - v10.4.6
Impact: Viewing a maliciously-crafted TIFF image may result in an application crash or arbitrary code execution
Description: By carefully crafting a corrupt TIFF image, an attacker can trigger a stack-based buffer overflow which may result in an application crash or arbitrary code execution. This update addresses the issue by performing additional validation of TIFF images. This issue does not affect systems prior to Mac OS X v10.4.
launchd
CVE-ID: CVE-2006-1471
Available for: Mac OS X v10.4 - v10.4.6, Mac OS X Server v10.4 - v10.4.6
Impact: Local users may gain elevated privileges
Description: A format string vulnerability in the setuid program launchd may allow an authenticated local user to execute arbitrary code with system privileges. The issue is present in launchd's logging facility. This update addresses the issue by performing additional validation when logging messages. This issue does not affect systems prior to Mac OS X v10.4. Credit to Kevin Finisterre of DigitalMunition for reporting this issue.
OpenLDAP
CVE-ID: CVE-2006-1470
Available for: Mac OS X v10.4 - v10.4.6, Mac OS X Server v10.4 - v10.4.6
Impact: Remote attackers may cause Open Directory server to crash
Description: By carefully crafting an invalid LDAP request, a remote attacker may be able to trigger an assertion in the OpenLDAP server, resulting in a denial-of-service. This update addresses the issue by discarding the invalid request. This issue does not affect systems prior to Mac OS X v10.4. Credit to the Mu Security research team for reporting this issue.
Mac OS X v10.4.7 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/
For Mac OS X v10.4.6 (PowerPC)
The download file is named: "MacOSXUpd10.4.7PPC.dmg"
Its SHA-1 digest is: 223d1fc9197a6a96c9d2f2a9110d37abc219c3a6
For Mac OS X v10.4 (PowerPC) through v10.4.6 (PowerPC)
The download file is named: "MacOSXUpdCombo10.4.7PPC.dmg"
Its SHA-1 digest is: c5c45dd81429520338caaef012b7da0e01a41f84
For Mac OS X v10.4.6 (Intel)
The download file is named: "MacOSXUpd10.4.7Intel.dmg"
Its SHA-1 digest is: 2a25ed61d586b71ba7282fb896b2c910785ff358
For Mac OS X v10.4.4 (Intel) or v10.4.5 (Intel)
The download file is named: "MacOSXUpdCombo10.4.7Intel.dmg"
Its SHA-1 digest is: 15b186d5f3a2314a060df3502eda190ad31a354d
For Mac OS X Server v10.4.6
The download file is named: "MacOSXServerUpdate10.4.7.dmg"
Its SHA-1 digest is: d83c3f6266f95f16e4b3abaebb6cdc89100dc41b
For Mac OS X Server v10.4 through v10.4.6
The download file is named: "MacOSXSrvrUpdCombo10.4.7.dmg"
Its SHA-1 digest is: 9ec47d4111072c3b908958a95459d0b18173e08c
Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798
・「Apple releases Mac OS X 10.4.7 Update」AppleInsider
・「Apple releases Mac OS X 10.4.7 Update」macosXrumors
・「Mac OS X 10.4.7 Update Now Available」Mac Rumors
・「Apple releases Mac OS X 10.4.7」MacNN
・「Apple releases Mac OS X 10.4.7」Macworld
・「アップル、「Mac OS X 10.4.7」を公開--脆弱性の修正や機能アップデートを含む
・「Apple、Mac OS X 10.4.7をリリース」ITmedia News