Security Update 2012-004 and Mail Plugins
Why does Security Update 2012-004 for 10.6 kick out Mail 4.6 Plugins like GrowlMail 1.2.5?
MacBook Pro, Mac OS X (10.6)
Apple Event: May 7th at 7 am PT
Why does Security Update 2012-004 for 10.6 kick out Mail 4.6 Plugins like GrowlMail 1.2.5?
MacBook Pro, Mac OS X (10.6)
from http://support.apple.com/kb/HT5501
"Impact: Viewing an e-mail message may lead to execution of web plugins
Description: An input validation error existed in Mail's handling of embedded web plugins. This issue was addressed by disabling third-party plug-ins in Mail."
I don't pretend to understand the technical nature of the vulnerability, but simply read those Mail plug-ins could be risky.
Isn't it great that Snow Leopard got a security update!!! A big THANK YOU Apple. Keep it going.
Indev has betas up on their support page to make Mail Act-On, Mail-Tags and Mail Perspectives compatible with the security release. Hurrah.
I can confirm that Mail Act-On is working again. I don't use the other two.
Now to see about Spam Sieve…
Another stupid question: How whole path should looks like? SSD/Users/lecho/Library/Mail/Bundles/GrowlMail.mailbundle/Contents/Info SupportedPluginCompatibilityUUIDs -array-add "...
Please type it exactly, how it should be written. I'm not a unix guru :-(
It works as mweger discribed! Thx a lot guys!
SpamSieve also has a working beta up to fix their (great) plugin. Get it via c-command.com/spamsieve/support.
If anyone is counting, Mail's built-in junk filters managed to rack up three false positives in the 15 or so minutes that I was running without SpamSieve.
My work here is done.
Mail Act-On has an update you can install to solve this problem.
But sorry, I don't understand what you mean by "The bottom one (under 5.) works for Letterbox and for MailActOn as well, just change 'GrowlMail' to 'Letterbox' or to 'MailActOn'."
Can you elaborate a tad on that please. I'm livid trying to live without Letterbox.
I edited the plist in TextEdit by making a duplicate of the original and adding the two UUIDs previoulsy posted and then putting it in the bundles folder, but saw no change.
I'm running 10.7.5 and Growl 2.0. I have no idea what version of GrowlMail.
On edit, I was running GrowlMail 1.3.3.
I have just updated Attachment Tamer. You can download it from http://lokiware.info/. (Unfortunatelly Apple does not seed security updates to developers and I was away from my computer most of the day, so I could not fix it earlier.)
Sweejak, if possible, undo what you did. I'm also running 10.7.5, Growl 2.0 and GrowlMail 1.3.3. Based on the info thankfully provided by lesse, here is precisely what I did and I hope it works for you:
1. Close Mail
2. If the plugin already got moved to “~/Library/Mail/Bundles (Disabled)/” move it back to “~/Library/Mail/Bundles/”
3. Open Terminal
4. defaults write ~/Library/Mail/Bundles/GrowlMail.mailbundle/Contents/Info SupportedPluginCompatibilityUUIDs -array-add "758F235A-2FD0-4660-9B52-102CD0EA897F"
5. defaults write ~/Library/Mail/Bundles/GrowlMail.mailbundle/Contents/Info SupportedPluginCompatibilityUUIDs -array-add "3335F782-01E2-4DF1-9E61-F81314124212"
Many thanks Don, I admit it, I'm a P***y when it comes to the Terminal, but that worked just fine.
I've got a further question now that I'm getting notifications, I'm not getting sound. Do I turn off the sound in Mail and then turn on sound in GrowlMail by going to GrowlMail>notifications> Actions> SoundAction?
Once there I see that there isn't a pull down to select a sound.
Or, Just go to Mail turn on the sound I want and set GrowlMail to "Application Default"?
On edit... I've got it so nevermind. I've set it to SoundAction in GrowlMail And left the sound in Mail active.
Message was edited by: Sweejak
Sweejak, just fyi, I set my sound notification in Mail prefs. Glad you sorted it out 🙂.
A big thanks to Adam re Attachment Tamer by responding to this wonderful Apple issue so quickly!
Put Letterbox back in the bundles folder, open terminal and type:
defaults write ~/Library/Mail/Bundles/Letterbox.mailbundle/Contents/Info SupportedPluginCompatibilityUUIDs -array-add 064442B6-53C0-4A97-B71B-2F111AE4195B 588FF7D1-4310-4175-9980-145B7E975C02
For me that made it work again...
For anyone using the notification plugin Herald, there is an updated version - 1.3.3. - at
Well, I'll be ******. That worked for me, too. Jazzmosax, you are today's Best Person In The World. Take the rest of the day off.
Many thanks.
Fantastic – you’re a star Lesse!
I’m on 10.6.8 using Mail 4.6 with Letterbox
This one worked for me:
defaults write ~/Library/Mail/Bundles/Letterbox.mailbundle /Contents/Info SupportedPluginCompatibilityUUIDs -array-add "064442B6-53C0-4A97-B71B-2F111AE4195B"
Security Update 2012-004 and Mail Plugins