Emergency IE Patch Released

Microsoft has released an emergency patch to combat attacks against Internet Explorer.

The critical update MS08-078 exploits IE's XML Handling Remote Code Execution.

The vulnerability could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Download and patch now!

Mac OS X 10.5.6 Now Available

For Mac OS X Leopard owners, Apple has released a new update 10.5.6. Wonder what's new in this update? See below or check the Apple Support Page.

Important Fixes Done:

•  Address Book - reliability syncing with iPhone and other devices and applications. 
• AirPort - improvements when roaming in large wireless networks with an Intel-based Mac.  
• Client management - fixes an issue in Mac OS X 10.5.4 and 10.5.5 in which managed users may not see printers that use the Generic PPD.
• iChat - addresses an issue that could cause an encryption alert to appear in the chat window; setting your iChat status to "invisible" via AppleScript no longer logs you out of iChat; resolves an issue in which pasting text from a Microsoft Office document could insert an image rather than text. 
• Graphics - fixes for possible graphics distortion issues with certain ATI graphics cards. 
• Mail - fixes an issue that could cause messages identified as junk to remain in the inbox, or cause Mail to append a character to the file extension of an attachment.
• Networking - improves Apple File Service performance, especially when using a home directory hosted on an AFP server.
• Time Machine - fixes issues that could cause Time Machine to state the backup volume could not be found.

General

• Includes Mac OS X security improvements.
• Addresses inaccuracies with Calculator when the Mac OS X language is set to German or Swiss German.
• Improves the performance and reliability of Chess.
• Improves DVD Player performance and reliability.
• Performance improvements for iCal are included.
• Fixes an issue when running the New iCal Events Automator action as an applet.
• Adds a Trackpad System Preference pane for portable Macs.
• Improves compatibility with smart cards such as the U.S. Department of Defense Common Access Card.
• Updates time zone data and Daylight Saving Time rules for several countries.

Browser Security Handbook

Google has released a Browser Security Handbook on Wednesday, Dec. 10. The said document is "meant to provide web application developers, browser engineers, and information security researchers with a one-stop reference to key security." The handbook consists of three parts that tackles basic to advanced security features, browser-specific issues and weaknesses.

It's about time. Browsers are potential ground for attackers to spread malicious contents popularly through (but not limited to) plugins or add-ons.

[source: http://code.google.com/p/browsersec/wiki/Main]