New QuickTime fixes a number of security vulnerabilities
Posted on 09 November 2012.
In a new security advisory, Apple addressed a number of vulnerabilities in QuickTime for Windows and announced a new version - 7.7.3. This is the list of security vulnerabilities fixed in this release.

Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of REGION records in PICT files. This issue was addressed through improved bounds checking.
CVE-2011-1374 : Mark Yason of the IBM X-Force

Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of PICT files. This issue was addressed through improved bounds checking.
CVE-2012-3757 : Jeremy Brown at Microsoft and Microsoft Vulnerability Research (MSVR)

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime plugin's handling of '_qtactivex_' parameters within a HTML object element. This issue was addressed through improved memory handling.
CVE-2012-3751 : chkr_d591 working with iDefense VCP

Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of the transform attribute in text3GTrack elements. This issue was addressed through improved bounds checking.
CVE-2012-3758 : Alexander Gavrun working with HP TippingPoint's Zero Day Initiative

Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution
Description: Multiple buffer overflows existed in the handling of style elements in QuickTime TeXML files. These issues were addressed through improved bounds checking.
CVE-2012-3752 : Arezou Hosseinzad-Amirkhizi, Vulnerability Research Team, TELUS Security Labs

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the QuickTime plugin's handling of MIME types. This issue was addressed through improved bounds checking.
CVE-2012-3753 : Pavel Polischouk, Vulnerability Research Team, TELUS
Security Labs

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime ActiveX control's handling of the Clear() method. This issue was addressed through improved memory management.
CVE-2012-3754 : CHkr_d591 working with iDefense VCP

Impact: Viewing a maliciously crafted Targa file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of Targa image files. This issue was addressed through improved bounds checking.
CVE-2012-3755 : Senator of Pirates

Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'rnet'
boxes in MP4 files. This issue was addressed through improved bounds checking.
CVE-2012-3756 : Kevin Szkudlapski of QuarksLab





Spotlight

Internet Explorer vulnerabilities increase 100%

Posted on 23 July 2014.  |  Bromium Labs research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Jul 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //