My issue is that on 2 of my computer, every time I get a notification to update iTunes, the updater has selected Safari by default to be installed. This does not happen on my 3rd computer.
What's the difference between these 3 PCs? No idea but iTunes users on Windows must be eternally vigilant to make sure they haven't accidentally installed Safari.
Apple has shipped new versions of its Safari browser to fix numerous security holes that expose Windows users to malicious hacker attacks.
The Safari 5.1 and Safari 5.0.6 addresses gaping security holes in Safari and WebKit, the open-source browser rendering engine. These updates are available for Safari users running Windows XP SP2, Windows Vista and Windows 7.
According to Apple’s advisory, some of these vulnerabilities could lead to drive-by download attacks, full system compromise, denial-of-service conditions of cross-site scripting attacks.
Here’s a sample of some of the more serious Safari for Windows vulnerabilities:
- CFNetwork: The NTLM authentication protocol is susceptible to a replay attack referred to as credential reflection. Authenticating to a maliciously crafted website may lead to arbitrary code execution. To mitigate this issue, Safari has been updated to utilize protection mechanisms recently added to Windows. This issue does not affect Mac OS X systems.
- ColorSync: An integer overflow existed in the handling of images with an embedded ColorSync profile, which may lead to a heap buffer overflow. Opening a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution.
- CoreFoundation: An off-by-one buffer overflow issue existed in the handling of CFStrings. Applications that use the CoreFoundation framework may be vulnerable to an unexpected application termination or arbitrary code execution.
- CoreGraphics: An integer overflow issue existed in the handling of Type 1 fonts. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution.
- ImageIO: A heap buffer overflow existed in ImageIO’s handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution.
- ImageIO: A heap buffer overflow existed in ImageIO’s handling of CCITT Group 4 encoded TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution.
- libxml: A one-byte heap buffer overflow existed in libxml’s handling of XML data. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.
The Safari update also contains a massive WebKit update that expose users to denial-service conditions or arbitrary code execution.
The patches are being delivered via the Windows Apple Software Update application, or Apple’s Safari download site.
