Secunia

Apple has issued an update for Mac OS X, which fixes multiple vulnerabilities.

1) An error in the AFP server within the handling of users' search results can be exploited by malicious users to gain knowledge of the names of files and folders for which the user performing the search has no access to.

2) A vulnerability within the Freshclam command line utility in ClamAV can potentially be exploited to compromise a vulnerable system.

For more information:
SA19880

3) A boundary error in ImageIO within the handling of TIFF images can be exploited to cause a stack-based buffer overflow. This crashes an affected application and may allow arbitrary code execution when a specially crafted TIFF image is viewed.

4) A format string error within the logging functionality of the setuid program "launchd" can be exploited by local users to execute arbitrary code with system privileges.

5) An error within "slapd" of the OpenLDAP server when handling an anonymous bind operation can be exploited to crash the service via a malformed ldap-bind message.

Solution
Apply Mac OS X Update 10.4.7.
Further details available in Customer Area

Provided and/or discovered by
4) Kevin Finisterre
5) Mu Security research team

Original Advisory
Apple:
http://docs.info.apple.com/article.html?artnum=303973

DigitalMunition:
http://www.digitalmunition.com/DMA%5B2006-0628a%5D.txt

Mu Security:
http://labs.musecurity.com/advisories/MU-200606-02.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area