Microsoft Issues Emergency Security Patch For IE
Microsoft issued an emergency security patch Wednesday for all versions of Internet Explorer. The patch is considered a critical fix for the security flaw currently plaguing the IE browser. So far, more than 2 million computers are believed to have been infected.

Microsoft advisory

US-CERT: Microsoft Internet Explorer Data Binding Vulnerability
**********

Firefox issues eight patches for Web browser
Mozilla has issued eight patches for its Firefox Web browser, three of which fix problems classified as critical. The patches come after security experts have recommended using a browser other than Microsoft's Internet Explorer 7 and older versions of IE due to a dangerous vulnerability. Microsoft is due to release an emergency patch for that problem Wednesday.

Note this is the last update for Firefox 2. Users should upgrade to Firefox 3.

Mozilla advisory

Also:
Oops! Mozilla forgets Firefox 2 patch, must re-issue update
**********

Apple pushes out critical Mac OS X security patches
Apple has released a major set of security patches for its Mac OS X operating system, fixing a number of critical flaws in the software. The Mac OS X v10.5.6 update includes a critical update for Adobe Systems' Flash Player, fixing bugs that were disclosed last month. It also includes patches for several Mac OS libraries, the operating system kernel, and system utilities such as the BOM archiving software. In total, 21 bugs are patched in the update. IDG News Service, 12/15/2008.

Apple advisory
**********

Seven new updates from Gentoo:

JasPer (memory management, code execution)

Ruby (multiple flaws)

Dovecot (multiple flaws)

POV-Ray (code execution)

aview (temp files, symlink attack)

OpenOffice.org (multiple flaws)

Honeyd (temp files, symlink attack)
**********

Three new patches from Mandriva:

Firefox (multiple flaws)

enscript (buffer overflows, code execution)

wireshark (multiple flaws)
**********

Three new fixes from Debian:

Linux 2.6.18 (multiple flaws)

no-ip packages (buffer overflow, code execution)

uw-imap (multiple flaws)
**********

One new patch from Ubuntu:

Ruby (multiple flaws)
**********

Today's malware news:

Malware writers targeting McDonald's fans
PPandaLabs, Panda Security's laboratory for detecting and analyzing malware, has detected an email message claiming to be a special Christmas offer from McDonald's, but which really spreads the P2PShared.U worm. Panda Security, 12/13/2008.

Jason Meserve is multimedia editor at Network World.