New QuickTime fixes a number of security vulnerabilities
Posted on 09 November 2012.
In a new security advisory, Apple addressed a number of vulnerabilities in QuickTime for Windows and announced a new version - 7.7.3. This is the list of security vulnerabilities fixed in this release.

Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of REGION records in PICT files. This issue was addressed through improved bounds checking.
CVE-2011-1374 : Mark Yason of the IBM X-Force

Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of PICT files. This issue was addressed through improved bounds checking.
CVE-2012-3757 : Jeremy Brown at Microsoft and Microsoft Vulnerability Research (MSVR)

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime plugin's handling of '_qtactivex_' parameters within a HTML object element. This issue was addressed through improved memory handling.
CVE-2012-3751 : chkr_d591 working with iDefense VCP

Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of the transform attribute in text3GTrack elements. This issue was addressed through improved bounds checking.
CVE-2012-3758 : Alexander Gavrun working with HP TippingPoint's Zero Day Initiative

Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution
Description: Multiple buffer overflows existed in the handling of style elements in QuickTime TeXML files. These issues were addressed through improved bounds checking.
CVE-2012-3752 : Arezou Hosseinzad-Amirkhizi, Vulnerability Research Team, TELUS Security Labs

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the QuickTime plugin's handling of MIME types. This issue was addressed through improved bounds checking.
CVE-2012-3753 : Pavel Polischouk, Vulnerability Research Team, TELUS
Security Labs

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime ActiveX control's handling of the Clear() method. This issue was addressed through improved memory management.
CVE-2012-3754 : CHkr_d591 working with iDefense VCP

Impact: Viewing a maliciously crafted Targa file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of Targa image files. This issue was addressed through improved bounds checking.
CVE-2012-3755 : Senator of Pirates

Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'rnet'
boxes in MP4 files. This issue was addressed through improved bounds checking.
CVE-2012-3756 : Kevin Szkudlapski of QuarksLab





Spotlight

USBdriveby: Compromising computers with a $20 microcontroller

Posted on 19 December 2014.  |  Security researcher Samy Kamkar has devised a fast and easy way to compromise an unlocked computer and open a backdoor on it: a simple and cheap ($20) pre-programmed Teensy microcontroller.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Fri, Dec 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //