Headline Feeds
Apple (Nasdaq: AAPL) has issued a new security patch to cover seven vulnerabilities in its Mac OS X operating system, including e-mail, ColorSync, and its Safari browser. Secunia Research reported the vulnerabilities, which are categorized as "highly critical."
According to Apple, when Safari's "Block Pop-Up Windows" feature is not enabled, a malicious pop-up window could appear as being from a trusted site. If the "Block Pop-Up Windows" feature is enabled, then this issues does not occur. The update corrects the issue regardless of the setting.
Browser Wars
The news comes at an inopportune time. The browser wars are escalating -- largely because of concerns about security with Microsoft's (Nasdaq: MSFT) Windows operating system and its Internet Explorer browser -- and Safari is actually gaining momentum in the marketplace, according to market researcher WebSideStory.
Between the beginning of December and mid-January, Microsoft's Internet Explorer market share dropped 1.5 percent while Safari gained nearly 1 percent.
Jupiter Research analyst Joe Wilcox told MacNewsWorld that technology users need to keep flaws in context. Two of Apple's largest competitors, Microsoft's Internet Explorer and Mozilla's Firefox, have also seen recent security warnings. Microsoft Windows operating system has also had its share of vulnerabilities.
"There are going to be security problems -- period," Wilcox said. "Regardless of the product, no developer has the resources to uncover every possible bug or flaw. You have to look at the number of flaws, whether or not they were exploited and how quickly the developer responds."
Apple's Response
Secunia has already issued three separate vulnerability advisories this year for Apple's OS X. Secunia reported 15 advisories related to the operating system last year. That compares to two advisories for Microsoft's Internet Explorer 6.0 browser alone -- not including for the entire Windows operating system -- this year and 34 last year.
Apple executives were not immediately available for comment.
The text displayed on the Web page that contains the downloadable patch stated: "For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available... Where possible, CVE (Common Vulnerabilities and Exposures) IDs are used to reference the vulnerabilities for further information."
The Security Update 2005-001 is for Mac OS X v10.2.8, Mac OS X Server v10.2.8, Mac OS X v10.3.7 and Mac OS X Server v10.3.7.
Talkback: 
