Following the release of iOS 5.1.1 earlier this week, Apple has released a whole slew of security updates for the Snow Leopard (OS X 10.6) and Lion (OS X 10.7) operating systems.
Update OS X 10.7.4
There are fixes for a whole host of issues here, ranging from data leakage of all kinds (including passwords), escalation of privilege, and remote code execution.
Included in this update is a fix for a serious flaw discovered in Apple's FileVault encryption tool. When working normally, FileVault encrypts the contents of the home folder, but in this case a programming error caused it to store user log on passwords in a plaintext file that anyone with access to the machine could read.
More details about the contents of this update available here.
Security update 2012-002 for 10.6.8
Many of the vulnerabilities affecting Lion also affect Snow Leopard. The only exception of any note is that the FileVault flaw only affects Lion.
More details about the contents of this update available here.
Remote Desktop Client update
For some odd reason, this update is included with OS X 10.7.4 for Lion but not update 2012-002 for 10.6.8 for Snow Leopard. This means you'll need to install this one separately if you are still on Snow Leopard.
Safari 5.1.7
One of the niftiest new features of Safari 5.1.7 is its ability to automatically switch off outdated versions of the Adobe Flash Player. Since vulnerabilities in Adobe's Flash Player is one of the commonest ways of spreading malware, running an outdated version of this plugin in not recommended.
When Flash Player is disabled, the user is shown a dialog and given an option to download the latest version.
Apple's step here of disabling Flash Player when it becomes outdated will go a long way to making OS X safer.
If, for any reason, you need to run an old version of Flash Player, Apple tells you how to bypass the automatic disable feature here. Unless you have a very specific reason for doing this, I DO NOT RECOMMED YOU DO IT.
Updating your Mac
The easiest way to bring these updates onto your system is to fire up Software Update and let it bring in all the updates your system needs. Depending on how long it has been since you last did this, it may be quick, or it may take some time to complete. Either way, it's something that you should do.
By default, Mac OS X doesn’t check for and install updates automatically (as is the default for Windows), and as such getting the patches to affected machines has to wait for users to apply the patches manually. However, if you're interested, there is a way to get Mac OS X to check for updates automatically. It might be a good idea to turn this on and set it to check for updates on a weekly basis.
