14 DAY TRIAL // In tandem with the release of Java for Mac OS X 10.5 Update 5, Apple has posted two additional Support articles outlining the versions it patches, as well as the exact issues it addresses. This release of J2SE 5.0 and J2SE 1.4.2 supports all Intel and PowerPC-based Macs, according to Apple.
“Java for Mac OS X 10.5 Update 5 delivers improved reliability, security, and compatibility for Java SE 6, J2SE 5.0 and J2SE 1.4.2. Java for Mac OS X 10.5 Update 5 supersedes all previous updates of Java for Mac OS X 10.5,” a summary of the update goes. However, since Java for Mac OS X 10.5 Update 5 is, first of all, a security update, the security content of Java for Mac OS X 10.5 Update 5 is the most important aspect.
Last modified on September 03, 2009, Support article HT3851 details the four vulnerabilities patched in Java for Mac OS X 10.5 Update 5.
“Multiple vulnerabilities exist in Java 1.6.0_13, the most serious of which may allow an untrusted Java applet to obtain elevated privileges,” Apple asserts. “Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_15,” the Mac maker reveals. Mac OS X 10.6 users are unaffected by these issues, according to the post.
“A stack buffer overflow exists in Java Web Start command launcher,” Apple discloses, describing another patched hole. “Launching a maliciously crafted Java Web Start application may lead to an unexpected application termination or arbitrary code execution,” the company says. Although late, Apple has addressed the issue “through improved bounds checking,” while the vuln doesn’t affect systems running Snow Leopard. Apple also credits Chris Ries of the Carnegie Mellon University Computing Services for reporting this issue.
For a complete list of the issues fixed in Java for Mac OS X 10.5 Update 5, visit Apple’s Support section here. To update to the latest version of Java available for OS X Leopard, use the link below.