Alert GCSA-12066 - APPLE-SA-2012-10-16-1 Java for OS X 2012-006 and

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

    Alert ID : GCSA-12066
        Data : 19 ottobre 2012
      Titolo : APPLE-SA-2012-10-16-1 Java for OS X 2012-006 and Java for Mac OS X 10.6 Update 11

******************************************************************


:: Descrizione del problema

    Sono state rilevate varie vulnerabilita' in Java 1.6.0_35 per Mac OS X,
    la piu' grave delle quali potrebbe consentire l'esecuzione
    di codice arbitrario ad applet Java non affidabili,
    durante la navigazione su pagine web artefatte.


:: Software interessati

    OS X Lion v10.7
    OS X Lion Server v10.7
    OS X Mountain Lion 10.8

    Mac OS X v10.6.8
    Mac OS X Server v10.6.8


:: Impatto

    Security Bypass
    Privilege escalation
    Denial of Service
    Accesso al sistema
    Esposizione di informazioni sensibili


:: Soluzione

    Aggiornare a Java SE 6 version 1.6.0_37

    L'upgrade puo' essere installato tramite il
    Software Update pane in System Preferences,
    o attraverso il sito web Apple:
    http://www.apple.com/support/downloads/

    Mac OS X: Updating your software
    http://support.apple.com/kb/HT1338

    Se non utilizzate gli applet Java e' consigliabile
    disabilitare il Java web plug-in nel browser.
    Per maggiori informazioni su come disabilitare
    Java in Safari consultare la seguente pagina:
    http://support.apple.com/kb/HT5241


:: Riferimenti

    Apple - Java for OS X 2012-006
    http://support.apple.com/kb/DL1572

    Apple security updates
    http://support.apple.com/kb/HT1222

    Oracle Update Release Notes
    http://www.oracle.com/technetwork/java/javase/releasenotes-136954.html

    Mitre CVE
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1531
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1532
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1533
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3143
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3159
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3216
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4416
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5068
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5069
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5071
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5072
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5073
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5075
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5077
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5079
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5081
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5083
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5084
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5086
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5089


-----BEGIN PGP SIGNATURE-----

iD8DBQFQgTH1wZxMk2USYEIRAou3AKDWqUrNPuIOfcU985dH2ku7ubnnxQCfcQSI
U/3FyhJvi1w3+Kk373LtNyg=
=Pqyo
-----END PGP SIGNATURE-----