Apple has released a security update for the Mac OS X operating system. The Mac OS X v10.6.4 can be downloaded and installed via Software Update preferences, or from Apple Downloads. The patch is available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6 through v10.6.3, Mac OS X Server v10.6 through v10.6.3

The security update patches many issues including:

- CUPS: Visiting a maliciously crafted website while logged into the CUPS web interface as an administrator may allow CUPS settings to be changed

- CUPS: A remote attacker may cause an unexpected application termination of cupsd

- CUPS: An attacker with access to the CUPS web interface may be able to read a limited amount of memory from the cupsd process

- DesktopServices: A Finder operation may result in files or folders with unexpected permissions

- Flash Player plug-in: Multiple vulnerabilities in Adobe Flash Player plug-in

- Folder Manager: Unmounting a maliciously crafted disk image or remote share may lead to data loss

- Help Viewer: Visiting a maliciously crafted website may lead to the execution of JavaScript in the local domain

- iChat: A remote user may upload files to arbitrary locations on the filesystem of a user currently using AIM in iChat

- ImageIO: Opening a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution

- ImageIO: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

- Kerberos: An unauthenticated remote user may cause an unexpected termination of the KDC process, or arbitrary code execution

- Kerberos: A remote user may cause an unexpected termination of the KDC process, or arbitrary code execution

- Kerberos: An unauthenticated remote user may cause an unexpected termination of the KDC process

- Using libcurl to download files from a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

- libcurl: A local user may obtain system privileges

- Network Authorization: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

- Network Authorization: A man-in-the-middle attacker may be able to impersonate a network account server

- Open Directory: Network devices may disable printing in certain applications

- Printer Setup: A user with access to the printer may cause an unexpected application termination or arbitrary code execution

- Ruby: A remote attacker may gain access to accounts served by Ruby WEBrick

- SMB File Server: A remote user may obtain unauthorized access to arbitrary files

- SquirrelMail: Multiple vulnerabilities in SquirrelMail

- Wiki Server: Viewing maliciously crafted Wiki content may result in a cross-site scripting attack