----------------------------------------------------------------------

2003: 2,700 advisories published
2004: 3,100 advisories published
2005: 4,600 advisories published
2006: 5,300 advisories published

How do you know which Secunia advisories are important to you?

The Secunia Vulnerability Intelligence Solutions allows you to filter
and structure all the information you need, so you can address issues
effectively.

Get a free trial of the Secunia Vulnerability Intelligence Solutions:
http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv

----------------------------------------------------------------------

TITLE:
Mac OS X Java Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA28115

VERIFY ADVISORY:
http://secunia.com/advisories/28115/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Privilege escalation, DoS, System access

WHERE:
>From remote

OPERATING SYSTEM:
Apple Macintosh OS X
http://secunia.com/product/96/

DESCRIPTION:
Some vulnerabilities have been reported and acknowledged  in Mac OS
X, which can be exploited by malicious people to bypass certain
security restrictions, conduct cross-site scripting attacks, to cause
a DoS (Denial of Service), or to compromise a user's system.

1) An error in Java due to an improper access check can be exploited
via a specially crafted Java applet to add or remove items from a
user's Keychain, without prompting the user.

This vulnerability affects Mac OS X versions prior to 10.5.

2) Some vulnerabilities in Java 1.4 and J2SE 5.0 can be exploited to
bypass certain security restrictions, conduct cross-site scripting
attacks, to cause a DoS (Denial of Service), or to compromise a
user's system.

For more information:
SA21709
SA23398
SA23445
SA23757
SA25069
SA25295
SA25769
SA25823
SA25981
SA26015
SA26402
SA27009

These vulnerabilities are reported in Mac OS X 10.4.10 and Mac OS X
Server 10.4.10. Mac OS X v10.5 is reportedly not affected.

SOLUTION:
Update to Java Release 6 for Mac OS X 10.4.

Java for Mac OS X 10.4, Release 6:
http://www.apple.com/support/downloads/javaformacosx104release6.html

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Bruno Harbulot, University of Manchester.

ORIGINAL ADVISORY:
Apple:
http://docs.info.apple.com/article.html?artnum=307177

OTHER REFERENCES:
SA21709:
http://secunia.com/advisories/21709/

SA23398:
http://secunia.com/advisories/23398/

SA23445:
http://secunia.com/advisories/23445/

SA23757:
http://secunia.com/advisories/23757/

SA25069:
http://secunia.com/advisories/25069/

SA25295:
http://secunia.com/advisories/25295/

SA25769:
http://secunia.com/advisories/25769/

SA25823:
http://secunia.com/advisories/25823/

SA25981:
http://secunia.com/advisories/25981/

SA26015:
http://secunia.com/advisories/26015/

SA26402:
http://secunia.com/advisories/26402/

SA27009:
http://secunia.com/advisories/27009/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------