Thinking maybe the new 10.7.4 update broke something. Was wondering if anyone caught wind of any issues on Lion. A cross-site scripting hole that was discovered at Google's Pwnium hacker contest has also been closed.It works for me too however I'm beginning to get reports of it not working right for some Lion users.

Another hole enabled a specially crafted page to fill in forms on other pages. A memory corruption issue in WebKit allowed systems to be infected with malicious code when a specially crafted web page was visited. The Samba server is not user in Mac OS X 10.7.Īpple has also released another security update for its Safari browser for Mac OS X and Windows. One fix, specifically for Mac OS X 10.6, Snow Leopard, is for the Samba server which, if active, allowed remote attackers to inject malicious code into a system without providing any valid access credentials. The developers have also fixed various non-security issues. Curl is now protected against problems such as the 'BEAST' attacks on encrypted connections. Apple has also closed a hole in the HFS filesystem that allowed Lion systems to be infected with malicious code by mounting a specially crafted disk image.

The company has also closed a hole in the kernel that, despite FileVault being activated, caused unencrypted files to be left behind when Lion was in hibernation.įurther vulnerabilities have been fixed in components such as the LoginUIFramework, where a race condition allowed guest users of Lion to log in as another user without having to enter a password. As the update does not have the ability to delete the accidentally stored data, Apple has provided instructions how to track down log files that could potentially contain plain text passwords. The problem was caused by a forgotten debug option being left enabled in the HomeDirMounter.

Those who continued to use the first version of the FileVault encryption after upgrading from Snow Leopard to Lion were also affected. Due to a mistake in the previous update, Lion stored the passwords of users who mounted their home/user directory from a network volume (NFS, AFP or SMB) in the system log unencrypted and readable by anyone with admin or physical access. The most prominent fix in this update sees the Apple developers have stopping Lion from storing plain text passwords. With the 10.7.4 Mac OS X Lion update and security update 2012-002 for 10.6, Apple has closed numerous critical vulnerabilities in Mac OS X and its components. As numerous critical holes are being closed in the update, users should not ignore this dialog

Java for mac os x lion 10.7.4