Apple released a Mac OS X update today, bring us up to 10.5.4. This update is available in Update and Combo Update flavors for Mac OS X 10.5 and Mac OS X 10.5 Server (gory details after the "read more"): Publishing pros will be happy to know that the 10.5.4 update includes fixes that help it play nicely with Adobe Creative Suite apps like InDesign and Photoshop. As noted by Adobe's Tim Cole on his blog:
Apple's 10.5.4 update contains more fixes for the Nav Services crash problem that manifests itself most frequently in InDesign. It also contains a fix for the file corruption problem that occurs when saving files to a remote server.


In addition, Apple also issued Security Update 2008-004 and Security Update 2008-004 Server in Intel and PPC varieties (gory details for this also after the "read more")

Mac OS X 10.5.4 update info:

General

  • Includes recent Apple security updates.
  • Resolves an issue with saving and reopening Adobe Creative Suite 3 files on a remote server.
  • Includes additional RAW image support for several cameras.
  • Addresses an issue that may result in a partially installed X11 application.
  • Improves L2TP VPN client reliability.

AirPort

  • Addresses AirPort reliability issues with 5GHz networks.
  • Addresses AirPort issues that may result in slower performance in Logic Studio or MainStage.

iCal

  • Improves overall iCal reliability for meeting requests, cancellation notices, delegation, and syncing with iPhone.
  • Resolves an issue that prevents deleting an iCal event without notifying the creator.
  • Addresses an issue in which events in all calendars affect availability. A checkbox now enables information-only calendars to be transparent from free/busy lookups.
  • Resolves a UI issue preventing delegated calendars from showing up as a separate window.
  • Addresses an issue with copying and pasting attendees from one event to another.
  • Resolves an issue in which iCal may not delete events after a specified time interval, even when set to do so in iCal preferences.
  • Addresses an issue in which To Dos cannot be marked private.

Safari

  • Addresses a potential performance issue when loading secure web pages.
  • Resolves issues that may be encountered when accessing secure web pages with client certificates that reside on a smart card.

Spaces and Exposé

  • Addresses an issue in which switching from a space with a Finder window keeps the Finder as the active application instead of the application residing in the destination space.
  • Fixes an issue in which dragging an application from the list of application assignments in Spaces System Preferences does not assign the application to the desired space.
  • Resolves an Exposé issue that may result in only a subset of windows being shown.

Nasty scenarios fixed by Security Update 2008-004:

Alias Manager

  • Resolving an alias containing maliciously crafted volume mount information may lead to an unexpected application termination or arbitrary code execution

CoreTypes

  • Users are not warned before opening certain potentially unsafe content types

c++filt

  • Passing a maliciously crafted string to c++filt may lead to an unexpected application termination or arbitrary code execution

Dock

  • A person with physical access may be able to bypass the screen lock

Launch Services

  • Visiting a maliciously crafted website may lead to arbitrary code execution

Net-SNMP

  • A remote attacker may be able to spoof an authenticated SNMPv3 packet

Ruby

  • Running a Ruby script that uses untrusted input to access strings or arrays may lead to an unexpected application termination or arbitrary code execution
  • If WEBRick is running, a remote attacker may be able to access files protected by WEBrick's :NondisclosureName option

SMB File Server

  • A remote attacker may be able to cause an unexpected application termination or arbitrary code execution

System Configuration

  • A local user may be able to execute arbitrary code with the privileges of new users

Tomcat

  • Multiple vulnerabilities in Tomcat 4.1.36

VPN

  • Remote attackers may be able to cause an unexpected application termination

WebKit

  • Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution