or Connect
AppleInsider › Forums › Software › Mac Software › Apple releases Safari 4.0.4 with security flaw patch
New Posts  All Forums:Forum Nav:

Apple releases Safari 4.0.4 with security flaw patch

post #1 of 40
Thread Starter 
Apple Wednesday afternoon released an update to its Safari Web browser, addressing a vulnerability that could allow an image file to exploit Macs with older software.

According to Apple, the flaw allowed maliciously crafted images with an embedded color profile to execute arbitrary code, or unexpectedly terminate the application. The issue does not affect Mac OS X 10.6 systems, and was already addressed with Security Update 2009-005 for Mac OS X 10.5.8 systems.

The 36.2MB download is available via Software Update. In addition to the security patch, Safari 4.0.4 is said to offer:

Improved JavaScript performance

Improved Full History Search performance for users with a large number of history items

Stability improvements for third-party plug-ins, the search field and Yahoo Mail
The last update to Safari, 4.0.3, was released in August. It provided stability improvements for Web pages that use the HTML 5 video tag, and fixed issues that prevented some users from logging into iWork.com
post #2 of 40
I told you!
Now comes Safari to be followed by iTunes,to be followed by iPhone, to be followed by AppleTV, etc, et,c and then back again.

I know - quit complaining- it's the Love Train!
post #3 of 40
Jeez! I just did the last security update to my wifes MacBook pro at 4:00 pm today. This must be hot off the presses!
post #4 of 40
Still no flash fix.
post #5 of 40
Quote:
Originally Posted by teckstud View Post

Still no flash fix.

Yeah, it would be nice if Adobe would work on that.
post #6 of 40
I just discovered that Webkit does not support MathML ( the xml tags used to render mathematical notation) Firefox does though. I just landed a nice job to write an application for such so I'm a little bummed. I usually use Safari but no dice on this job. For anyone one else interested, a new JS library is in the works to be released soon to fix the lack of support in Webkit. It is called MathJax

Life is too short to drink bad coffee.

Reply

Life is too short to drink bad coffee.

Reply
post #7 of 40
It definitely feels snappier!
post #8 of 40
Quote:
Originally Posted by mstone View Post

I just discovered that Webkit does not support MathML

But...but... Safari gets 100/100 in ACID3 and is therefore must be the most standard compliant browser ever...although only IE8 supports CSS 2.1 fully...*head explodes*
post #9 of 40
404 doesn't seem like a great number for a browser.


post #10 of 40
Quote:
Originally Posted by teckstud View Post

I told you!
Now comes Safari to be followed by iTunes,to be followed by iPhone, to be followed by AppleTV, etc, et,c and then back again.

I know - quit complaining- it's the Love Train!

you'd have nothing to say if you didn't complain.
post #11 of 40
At least, in Yahoo mail, that annoying blue, spinning disc is gone.
post #12 of 40
Quote:
Originally Posted by teckstud View Post

I told you!
Now comes Safari to be followed by iTunes,to be followed by iPhone, to be followed by AppleTV, etc, et,c and then back again.

I know - quit complaining- it's the Love Train!

Ya, I wish the company that built my computer and phone didn't issue updates and patches.
post #13 of 40
Flash still crashes frequently throughout the day. Hell after I rebooted and went to chron.com, flash crashed before it even loaded the page. The Fuck!
post #14 of 40
Could somebody please explain to me why this update requires a reboot, despite the fact that no other browser on any other operating system I know of requires a reboot after install?

I'm on Snow Leopard, for God's sake! You'd think Apple would have worked out the legacy issues, including QuickTime 7 and any Carbon libraries.
post #15 of 40
Quote:
Originally Posted by mstone View Post

I just discovered that Webkit does not support MathML ( the xml tags used to render mathematical notation) Firefox does though. I just landed a nice job to write an application for such so I'm a little bummed. I usually use Safari but no dice on this job. For anyone one else interested, a new JS library is in the works to be released soon to fix the lack of support in Webkit. It is called MathJax

Firefox looks to only support partial MathML. If you want real support youll have to go with Opera. Note that its coming to WebKit.
http://webkit.org/projects/mathml/index.html
Quote:
Originally Posted by Erunno View Post

But...but... Safari gets 100/100 in ACID3 and is therefore must be the most standard compliant browser ever...although only IE8 supports CSS 2.1 fully...*head explodes*

Fully? This Wikipedia page paints a different picture. Granted, its Wikipedia and its a complex page that could easily be out of date, but all the main browsers seem pretty on the ball.
http://en.wikipedia.org/wiki/Compari...g_Style_Sheets) PS: Acid3 wasnt designed to test for everything. Its designed that way. Acid4 will likely work the same way.


Quote:
Originally Posted by estolinski View Post

Ya, I wish the company that built my computer and phone didn't issue updates and patches.

Now hes complaining that Apples issues updates to their apps???
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
post #16 of 40
Quote:
Originally Posted by JavaCowboy View Post

Could somebody please explain to me why this update requires a reboot, despite the fact that no other browser on any other operating system I know of requires a reboot after install?

Just to vex you.
post #17 of 40
Quote:
Originally Posted by JavaCowboy View Post

Could somebody please explain to me why this update requires a reboot, despite the fact that no other browser on any other operating system I know of requires a reboot after install?

I'm on Snow Leopard, for God's sake! You'd think Apple would have worked out the legacy issues, including QuickTime 7 and any Carbon libraries.

Simply put, youre not just updating Safari.app or QuickTime.app when Apples issue an update, they are also updating the frameworks that are loaded when you start your machine.
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
post #18 of 40
Quote:
Originally Posted by ghostface147 View Post

Flash still crashes frequently throughout the day. Hell after I rebooted and went to chron.com, flash crashed before it even loaded the page. The Fuck!

Adobe really needs to fix Flash an make a 64-bit plug-in. If you are on battery and using Safari you are best to run in 32-bit mode otherwise you suffer a hue power drain in you are using Flash.
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
post #19 of 40
Quote:
Originally Posted by JavaCowboy View Post

Could somebody please explain to me why this update requires a reboot, despite the fact that no other browser on any other operating system I know of requires a reboot after install?

I'm on Snow Leopard, for God's sake! You'd think Apple would have worked out the legacy issues, including QuickTime 7 and any Carbon libraries.

It's not clear why and I agree with you this really shouldn't be a necessity to reboot at this point.
post #20 of 40
Did anyone do a permissions repair after this update and find that a TON of permissions had to be repaired? I did. And I just repaired permissions the other day with the 10.6.2 update.
post #21 of 40
Quote:
Originally Posted by ghostface147 View Post

Flash still crashes frequently throughout the day. Hell after I rebooted and went to chron.com, flash crashed before it even loaded the page. The Fuck!

I thought I read somewhere that with Snow Leopard (or was it Safari 4.0?) that when a plug-in crashes, as Flash does a lot, only the plug-in would crash and not all of Safari. Does anyone see this? My Safari is still crashing when Flash does.

MBP Core Duo (1,1)
10.6.2
Safari 4.04 (but 4.04 hasn't crashed yet)
post #22 of 40
Quote:
Originally Posted by JupiterOne View Post

I thought I read somewhere that with Snow Leopard (or was it Safari 4.0?) that when a plug-in crashes, as Flash does a lot, only the plug-in would crash and not all of Safari. Does anyone see this? My Safari is still crashing when Flash does.

MBP Core Duo (1,1)
10.6.2
Safari 4.04 (but 4.04 hasn't crashed yet)

Fully uninstall Flash then restart, then reinstall it. See if that helps.
http://www.adobe.com/shockwave/download/alternates/
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
post #23 of 40
Quote:
Originally Posted by JupiterOne View Post

Did anyone do a permissions repair after this update and find that a TON of permissions had to be repaired? I did. And I just repaired permissions the other day with the 10.6.2 update.

Only a few... like only enough that its gonna take 30 MINUTES TO FIX... what happened with this update...?

And I did a permissions repair before and after 10.6.2 (nothing came up either time)....
post #24 of 40
Quote:
Originally Posted by mstone View Post

I just discovered that Webkit does not support MathML ( the xml tags used to render mathematical notation) Firefox does though. I just landed a nice job to write an application for such so I'm a little bummed. I usually use Safari but no dice on this job. For anyone one else interested, a new JS library is in the works to be released soon to fix the lack of support in Webkit. It is called MathJax

Seriously if this is something you think is important to support, you need to log it with Apples bug tracking system. Further letting the big guy at the top know what is important to you is very important.

I'm not saying you will see an instant change with respect to the support of MathML but you may have a chance of getting MathML on to a future feature set list. YOu might also want to look at WebKit betas, I don't use MathML myself so I'm not sure what they might be implementing. It is pretty obvious that Apples primary focus lately have been performance improvements and HTML5. However the development of Safari won't stop just because those items get fixed.

Dave
post #25 of 40
Quote:
Originally Posted by solipsism View Post

Simply put, youre not just updating Safari.app or QuickTime.app when Apples issue an update, they are also updating the frameworks that are loaded when you start your machine.

So why does updating these frameworks require a reboot? Even the last iTunes update didn't require a reboot, whereas pre-Snow Leopard it would ask for a QuickTime update in lock-step and that would require a reboot.
post #26 of 40
Quote:
Originally Posted by JavaCowboy View Post

So why does updating these frameworks require a reboot? Even the last iTunes update didn't require a reboot, whereas pre-Snow Leopard it would ask for a QuickTime update in lock-step and that would require a reboot.

Go to System/Library/Frameworks/. There is a WebKit and QuickTime framework. iTunes uses the QuickTime framework and others, but until those are updated iTunes doesnt require and update. Now you are probably wondering why its a WebKit framework and not a Safari framework. Well, Safari is just and app but the WebKit engine is part of the OS. There is a reason why Mac OS X has long had options like QuickLook that allow for reading documents and playing media without launching a specific app. These are all part of the frameworks built into the subsystem. The solution is simple. If you dont like an integrated OS dont use Mac OS X. Apple is going to tie more things together, not less, so this will only become more of a problem for you int he future.
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
post #27 of 40
I was running the latest update a little while ago and it must be said it looks snappy. It makes me wonder just how fast Safari can get, it sure does make IE look really bad.

The next thing we could use is a Mail update. I'm still using Thunderbird on my Mac as it just seems more logical and stable.

Dave
post #28 of 40
there was a HUGE amount of permission problems with mine...seriously seemed like atleast 100
post #29 of 40
Quote:
Originally Posted by alectheking View Post

there was a HUGE amount of permission problems with mine...seriously seemed like atleast 100

Just language localizations and such within the app contents. Nothing to be concerned with.
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
post #30 of 40
Quote:
Originally Posted by wizard69 View Post

Seriously if this is something you think is important to support, you need to log it with Apples bug tracking system. Further letting the big guy at the top know what is important to you is very important.

I'll direct the scientific community to review your proposal and advise that their suplication to the 'big guy' should include a prayer for html5 support of MathML.

Life is too short to drink bad coffee.

Reply

Life is too short to drink bad coffee.

Reply
post #31 of 40
Quote:
Originally Posted by solipsism View Post

Firefox looks to only support partial MathML. If you want real support youll have to go with Opera. Note that its coming to WebKit.
http://webkit.org/projects/mathml/index.html

I'm pretty sure that I've seen the WebKit MathML page at least 3 years ago for the first time and that it hasn't changed much since then. It doesn't look like it's high on the priority list of the WebKit developers (the science community will thank them for that).

Quote:
Fully? This Wikipedia page paints a different picture. Granted, its Wikipedia and its a complex page that could easily be out of date, but all the main browsers seem pretty on the ball.

http://www.w3.org/Style/CSS/

Quote:
2009-03-23 Microsoft released version 8 of Internet Explorer, with full CSS level 2 support, plus some internationalization features from level 3. (Windows, free)

Microsoft developed and submitted thousands of new tests for CSS 2.1 during the development of IE8 and caught the other browser vendors pants down after all of their self-proclaimed superior standard support. Instead of chasing after the newest shiny thing (CSS 3, CSS animation, WebGL, etc.) maybe the Gecko and WebKit developers should sit down and fix the existent and widely used technologies first. Actually, Microsoft provided a very good example how absurd the focus on the ACID test suites is as they cover only small subsets of the tested standards (something I now at least some Gecko developers complained about).

Quote:
PS: Acid3 wasnt designed to test for everything. Its designed that way. Acid4 will likely work the same way.

See the above paragraph. It's actually almost ironic that Microsoft is doing the tiresome work of completing the CSS test suites, something I would have expected from our self-proclaimed champions of standard conformity for the sake correctness and verifiability.
post #32 of 40
Quote:
Originally Posted by JavaCowboy View Post

Could somebody please explain to me why this update requires a reboot, despite the fact that no other browser on any other operating system I know of requires a reboot after install?

I'm on Snow Leopard, for God's sake! You'd think Apple would have worked out the legacy issues, including QuickTime 7 and any Carbon libraries.

Yeah, there's a minute and a half you'll never get back, huh? ... poor baby.
See, in the record business, you can show someone your song, and they don’t copy it. In the tech business, you show somebody your idea, and they steal it. (Jimmy Iovine)
Reply
See, in the record business, you can show someone your song, and they don’t copy it. In the tech business, you show somebody your idea, and they steal it. (Jimmy Iovine)
Reply
post #33 of 40
Quote:
Originally Posted by JupiterOne View Post

Did anyone do a permissions repair after this update and find that a TON of permissions had to be repaired? I did. And I just repaired permissions the other day with the 10.6.2 update.


I just installed and did permissions repair .... got nothing, nada, but I'm still on Tiger, if that means anything.
See, in the record business, you can show someone your song, and they don’t copy it. In the tech business, you show somebody your idea, and they steal it. (Jimmy Iovine)
Reply
See, in the record business, you can show someone your song, and they don’t copy it. In the tech business, you show somebody your idea, and they steal it. (Jimmy Iovine)
Reply
post #34 of 40
Quote:
Originally Posted by newbee View Post

Yeah, there's a minute and a half you'll never get back, huh? ... poor baby.

A true Unix geek brags about their uptime, and OS X is Unix with a poor uptime
post #35 of 40
Quote:
Originally Posted by solipsism View Post

Go to System/Library/Frameworks/. There is a WebKit and QuickTime framework. iTunes uses the QuickTime framework and others, but until those are updated iTunes doesnt require and update. Now you are probably wondering why its a WebKit framework and not a Safari framework. Well, Safari is just and app but the WebKit engine is part of the OS. There is a reason why Mac OS X has long had options like QuickLook that allow for reading documents and playing media without launching a specific app. These are all part of the frameworks built into the subsystem. The solution is simple. If you dont like an integrated OS dont use Mac OS X. Apple is going to tie more things together, not less, so this will only become more of a problem for you int he future.

Again, why do updates to the framework require a reboot? It's not like a security or system update where the kernel itself is being overwritten.
post #36 of 40
Quote:
Originally Posted by JavaCowboy View Post

A true Unix geek brags about their uptime, and OS X is Unix with a poor uptime

Seriously, anyone who brags abut uptime has got be a complete douche.

Quote:
Originally Posted by JavaCowboy View Post

Again, why do updates to the framework require a reboot? It's not like a security or system update where the kernel itself is being overwritten.

Let try to make this even simpler. Frameworks are loaded into memory when an application needs them. Safari is not the only application that uses the WebKit framework. They are shared across many applications. You would need to make sure that all applications that were using the framework have quit before being able to restart a new Framework. Do you not see how this can be an issue for a consumer machine if a Framework was forced quit while another app was using it? Its all pretty simple stuff. Its a system level component, so the proper protocol is to have the user restart the system when its convenient for them.
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
post #37 of 40
Quote:
Originally Posted by JavaCowboy View Post

and OS X is Unix with a poor uptime

Really?

Which of us is the fisherman and which the trout?

Reply

Which of us is the fisherman and which the trout?

Reply
post #38 of 40
Quote:
Originally Posted by solipsism View Post

Seriously, anyone who brags abut uptime has got be a complete douche.


Let try to make this even simpler. Frameworks are loaded into memory when an application needs them. Safari is not the only application that uses the WebKit framework. They are shared across many applications. You would need to make sure that all applications that were using the framework have quit before being able to restart a new Framework. Do you not see how this can be an issue for a consumer machine if a Framework was forced quit while another app was using it? Its all pretty simple stuff. Its a system level component, so the proper protocol is to have the user restart the system when its convenient for them.

So why not ask them to log out and log back in? That would seem to be the simpler solution than forcing a reboot, and would be much less of a pain.
post #39 of 40
Quote:
Originally Posted by Povilas View Post

Really?

If it weren't for all the reinstalls that required reboots, no. Otherwise, I'd never have to reboot OS X, contrary to XP and previous versions of Windows, where practically every application install requires a reboot, and the colloquial "solution to all Windows problems" is a reboot. By contrast, only kernel updates seem to require a reboot in Linux.
post #40 of 40
Quote:
Originally Posted by JavaCowboy View Post

So why not ask them to log out and log back in? That would seem to be the simpler solution than forcing a reboot, and would be much less of a pain.

Quote:
Originally Posted by JavaCowboy View Post

If it weren't for all the reinstalls that required reboots, no. Otherwise, I'd never have to reboot OS X, contrary to XP and previous versions of Windows, where practically every application install requires a reboot, and the colloquial "solution to all Windows problems" is a reboot. By contrast, only kernel updates seem to require a reboot in Linux.

Mac OS X is not Linux.
Mac OS X is not trying to be Linux.
Mac OS X is a consumer OS built to sell Apple’s PCs.

Apple has made some very distinct changes in the way system level components are installed between Leopard and Snow Leopard. With Snow Leopard these major updates are done without the user being able to use the system.

Logging out doesn’t mean that frameworks are still not being utilized. If you put yourself in Apple’s shoes as a company supporting consumers perhaps you can imagine this as a fail safe to make OS upgrades less problematic. What you call “simpler” may not be the case for Apple’s technical support. If you’ve ever taken a business courses you may understand some of the pitfalls of growth.

It’s a bit annoying to have to do, which is why I don’t do an update because it’s there. Apple clearly informs you which updates require an restart. If you don’t like it then don’t update or don’t use the OS. They have decided the how and why and I’m certain it was done for actual reason that inevitably has a financial reason more so than to piss you off.
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
Dick Applebaum on whether the iPad is a personal computer: "BTW, I am posting this from my iPad pc while sitting on the throne... personal enough for you?"
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Mac Software
AppleInsider › Forums › Software › Mac Software › Apple releases Safari 4.0.4 with security flaw patch