AFP Client - Arbitrary code execution due to poor handling of malicious afp:// URLs
AFP Server - Cross-realm authentication can be bypassed
Apache - Numerous vulnerabilities affecting supplied Apache versions
AppKit - Arbitrary code execution risks from a range of vulnerabilities.
Application Firewall - German translation of Preference Pane fixed.
CFNetwork - Spoofing of secure (https) content is possible
ClamAV - Numerous arbitrary code execution vulnerabilities
CoreFoundation - Arbitrary code execution through integer overflow when handling time zone data.
CoreServices - AppleWorks may be convinced to open files ending in .ief if Safari's "Open Safe files" preference is enabled.
CUPS - Multiple arbitrary code execution vulnerabilities.
curl - Possible arbitrary code execution when interacting with a malicious URL.
Emacs - Multiple arbitrary code execution vulnerabilities possible via the built-in Lisp interpreter.
file - Arbitrary code execution when using 'file' on a malicious file.
Foundation - Multiple arbitrary code execution vulnerabilities
Help Viewer - Malicious help: URLs may lead to arbitrary Applescript execution
Image Raw - Viewing a malicious image may lead to arbitrary code execution
Kerberos - Multiple arbitrary code execution and denial of service vulnerabilities
libc - Denial of Service possible for applications using the strnstr API.
mDNSResponder - Arbitrary code execution via privilege escalation
notifyd - System call spoofing
OpenSSH - Arbitrary code execution when used with X11.
pax archive utility - Arbitrary code execution risk when pax is run as a command line utility
PHP - Multiple arbitrary code execution vulnerabilities
Podcast Producer - Information disclosure (passwords) to other local users
Preview - Encrypted PDF saves may not adequately protect the file
Printing - Multiple Information disclosure opportunities
System Configuration - Arbitrary code execution
UDF - Denial of service (system shut down) when interacting with malicious disk images
Wiki Server - Arbitrary system access possible for users with edit access to the wiki
X11 - Numerous arbitrary code execution vulnerabilities

Description:

Earlier this week Apple released Security Update 2008-002 for Intel and PPC based Macs. Quite a number of fixes were included for a range of serious security problems.

Mitigation:

It is recommended that users apply the update, via the Software Update option in the Apple Menu, or via the Apple Download link, below. If installing via the Software Update option, it will only download the applicable Update (Intel / PPC / 10.5 / 10.4).

Updates:

http://www.apple.com/support/downloads/

Source:

http://docs.info.apple.com/article.html?artnum=61798

Exploits:

CVE-ID: CVE-2008-0044 (AFP Client), CVE-ID: CVE-2008-0045 (AFP Server), CVE-ID: CVE-2005-3352 (Apache), CVE-ID: CVE-2006-3747 (Apache), CVE-ID: CVE-2007-3847 (Apache), CVE-ID: CVE-2007-5000 (Apache), CVE-ID: CVE-2007-6388 (Apache), CVE-ID: CVE-2007-5000 (Apache), CVE-ID: CVE-2007-6203 (Apache), CVE-ID: CVE-2007-6388 (Apache), CVE-ID: CVE-2007-6421 (Apache), CVE-ID: CVE-2008-0005 (Apache), CVE-ID: CVE-2008-0048 (AppKit), CVE-ID: CVE-2008-0049 (AppKit), CVE-ID: CVE-2008-0057 (AppKit), CVE-ID: CVE-2008-0997 (AppKit), CVE-ID: CVE-2008-0046 (Application Firewall), CVE-ID: CVE-2008-0050 (CFNetwork), CVE-ID: CVE-2007-3725 (ClamAV), CVE-ID: CVE-2007-4510 (ClamAV), CVE-ID: CVE-2007-4560 (ClamAV), CVE-ID: CVE-2007-5759 (ClamAV), CVE-ID: CVE-2007-6335 (ClamAV), CVE-ID: CVE-2007-6336 (ClamAV), CVE-ID: CVE-2007-6337 (ClamAV), CVE-ID: CVE-2008-0318 (ClamAV), CVE-ID: CVE-2008-0728 (ClamAV), CVE-ID: CVE-2006-6481 (ClamAV), CVE-ID: CVE-2007-1745 (ClamAV), CVE-ID: CVE-2007-1997 (ClamAV), CVE-ID: CVE-2007-3725 (ClamAV), CVE-ID: CVE-2007-4510 (ClamAV), CVE-ID: CVE-2007-4560 (ClamAV), CVE-ID: CVE-2007-0897 (ClamAV), CVE-ID: CVE-2007-0898 (ClamAV), CVE-ID: CVE-2008-0318 (ClamAV), CVE-ID: CVE-2008-0728 (ClamAV), CVE-ID: CVE-2008-0051 (CoreFoundation), CVE-ID: CVE-2008-0052 (CoreServices), CVE-ID: CVE-2008-0596 (CUPS), CVE-ID: CVE-2008-0047 (CUPS), CVE-ID: CVE-2008-0053 (CUPS), CVE-ID: CVE-2008-0882 (CUPS), CVE-ID: CVE-2005-4077 (curl), CVE-ID: CVE-2007-6109 (Emacs), CVE-ID: CVE-2007-5795 (Emacs), CVE-ID: CVE-2007-2799 (file), CVE-ID: CVE-2008-0054 (Foundation), CVE-ID: CVE-2008-0055 (Foundation), CVE-ID: CVE-2008-0056 (Foundation), CVE-ID: CVE-2008-0058 (Foundation), CVE-ID: CVE-2008-0059 (Foundation), CVE-ID: CVE-2008-0060 (Help Viewer), CVE-ID: CVE-2008-0987 (Image Row), CVE-ID: CVE-2007-5901 (Kerberos), CVE-ID: CVE-2007-5971 (Kerberos), CVE-ID: CVE-2008-0062 (Kerberos), CVE-ID: CVE-2008-0063 (Kerberos), CVE-ID: CVE-2008-0988 (libc), CVE-ID: CVE-2008-0989 (mDNSResponder), CVE-ID: CVE-2008-0990 (notifyd), CVE-ID: CVE-2007-4752 (OpenSSH), CVE-ID: CVE-2008-0992 (pax archive utility), CVE-ID: CVE-2007-1659 (PHP), CVE-ID: CVE-2007-1660 (PHP), CVE-ID: CVE-2007-1661 (PHP), CVE-ID: CVE-2007-1662 (PHP), CVE-ID: CVE-2007-4766 (PHP), CVE-ID: CVE-2007-4767 (PHP), CVE-ID: CVE-2007-4768 (PHP), CVE-ID: CVE-2007-4887 (PHP), CVE-ID: CVE-2007-3378 (PHP), CVE-ID: CVE-2007-3799 (PHP), CVE-ID: CVE-2008-0993 (Podcast Producer), CVE-ID: CVE-2008-0994 (Preview), CVE-ID: CVE-2008-0995 (Printing), CVE-ID: CVE-2008-0996 (Printing), CVE-ID: CVE-2008-0998 (System Configuration), CVE-ID: CVE-2008-0999 (UDF), CVE-ID: CVE-2008-1000 (Wiki Server), CVE-ID: CVE-2007-4568 (X11), CVE-ID: CVE-2007-4990 (X11), CVE-ID: CVE-2006-3334 (X11), CVE-ID: CVE-2006-5793 (X11), CVE-ID: CVE-2007-2445 (X11), CVE-ID: CVE-2007-5266 (X11), CVE-ID: CVE-2007-5267 (X11), CVE-ID: CVE-2007-5268 (X11), CVE-ID: CVE-2007-5269 (X11), CVE-ID: CVE-2007-5958 (X11), CVE-ID: CVE-2008-0006 (X11), CVE-ID: CVE-2007-6427 (X11), CVE-ID: CVE-2007-6428 (X11), CVE-ID: CVE-2007-6429 (X11)