Browse archive

Latest news

Fighting cybercrime is on the right track

Google set to upgrade its SSL certs

IT security pros have trouble communicating with executives

Zeus variants are back with a vengeance

Facebook phishers target Fan Pages owners

Killer apps: The performance of networked applications

Is it time to professionalize information security?

Google researcher reveals another Windows 0-day

Twitter finally offers 2-factor authentication

DHS employees' info possibly compromised due to system flaw

Teens are into online sharing, but are also more privacy-aware

The dangers of downloading software from unofficial sites

Microsoft decrypts Skype comms to detect malicious links

Review: Logging and Log Management

Hacking charge stations for electric cars

QuickTime 7.6.9 fixes security issues

Posted on 08 December 2010.

Here is the security content related to QuickTime 7.6.9, available for download here.

A local user may have access to sensitive information
A filesystem permission issue exists in QuickTime. This may allow a local user to access the contents of the "Apple Computer" directory in the user's profile, which may lead to the disclosure of sensitive information. This issue is addressed through improved filesystem permissions. This issue does not affect Mac OS X systems.

Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution
A heap buffer overflow exists in QuickTime's handling of JP2 images. Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to Nils of MWR InfoSecurity, and Will Dormann of the CERT/CC, for reporting this issue.

Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution
An uninitialized memory access issue exists in QuickTime's handling of JP2 images. Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of JP2 images. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to Damian Put and Procyun, working with TippingPoint's Zero Day Initiative for reporting this issue.

Viewing a maliciously crafted avi file may lead to an unexpected application termination or arbitrary code execution
A memory corruption issue is in QuickTime's handling of avi files. Viewing a maliciously crafted avi file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of avi files. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to Damian Put working with TippingPoint's Zero Day Initiative for reporting this issue.

Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
A memory corruption issue exists in QuickTime's handling of movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of movie files. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5.

A buffer overflow exists in QuickTime's handling of MPEG encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5.

A signedness issue exists in QuickTime's handling of MPEG encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of MPEG encoded movie files. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5.

A memory corruption issue exists in QuickTime's handling of Sorenson encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of Sorenson encoded movie files. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5.

A heap buffer overflow exists in QuickTime's handling of Track Header (tkhd) atoms. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking. This issue does not affect Mac OS X systems.

An integer overflow exists in QuickTime's handling of movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking.

Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution
An uninitialized memory access issue exists in QuickTime's handling of FlashPix images. Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5.

Viewing a maliciously crafted GIF image may lead to an unexpected application termination or arbitrary code execution
An uninitialized memory access issue exists in QuickTime's handling of GIF images. Viewing a maliciously crafted GIF image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5.

Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
A memory corruption issue exists in QuickTime's handling of PICT files. Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of PICT files.

Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution
A memory corruption issue exists in QuickTime's handling of FlashPix images. Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management.

Viewing a maliciously crafted QTVR movie file may lead to an unexpected application termination or arbitrary code execution
A memory corruption issue exists in QuickTime's handling of panorama atoms in QTVR (QuickTime Virtual Reality) movie files. Viewing a maliciously crafted QTVR movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of QTVR movie files.