Apple's new Leopard operating system has been out in the open for a few weeks now, the company other OS is limping under the weight of over 40 security vulnerabilities.

Apple has released its 10.4.11 update for its now "older" Tiger Mac OS X. The update is the third point upgrade for the 10.4.x operating system this year and addresses security issues ranging from updates to the operating system right down to Tiger's kernel.

Among the 40 vulnerabilities addressed in the update, five are directed at kernel issues. CVE-2007-3749 details a flaw related to how the OS X kernel handles certain privileged binary files. The binary could be used by an attacker to execute arbitrary code.

CVE-2007-4686 also details a kernel flaw that could lead to arbitrary code execution. The flaw is triggered by a faulty iotcl request (input/output control) that issues commands from the kernel userspace to hardware.

Five of the 40 flaws address core networking. Apple's networking stack, AppleTalk, is the vulnerable component in all of the cases, with vulnerabilities that could trigger buffer overflows leading ultimately to arbitrary code execution and system crashes.

Web browsing will also be more secure in the 10.4.11 release, thanks to vulnerability fixes in the Safari browser and its WebCore supporting infrastructure.

CVE-2007-0646 details an issue whereby the act of downloading a file with a maliciously crafted name could allow for arbitrary code execution. The issue was first brought to light in the Month of Apple Bugs in January.

Tabbed browsing is also an issue addressed by the update. According to Apple's advisory, "If HTTP authentication is used by a site being loaded in a tab other than the active tab, an authentication sheet may be displayed, although the tab and its corresponding page are not visible."

LATEST NEWS

EU to Probe Microsoft on Open Source
Congress Questions Google on Privacy Practices
Customs, Travel and Tech Privacy
Critics Blast Microsoft Despite ODF Support Pledge
SugarCRM's Latest Is 'SaaS in a Box'

Apple also addresses third-party software issues. Among them is an updated Flash Player that protects against arbitrary code execution. There is also an update for the open source BIND DNS (define) server that provides additional security against cache poisoning that could lead to a DNS takeover.

Apple's big Mac OS update comes barely a week after updated to fix a number of security issues in the widely used QuickTime media player.