Apple Fixes Critical Flaws in QuickTime 7.7.3

Author: Dennis Fisher
minute read

Apple has fixed nine vulnerabilities in its QuickTime media player software, all of which can be used to execute arbitrary code on vulnerable machines. Several of the flaws are buffer overflows, and users who still run QuickTime should update it as soon as possible.

Quicktime patchApple has fixed nine vulnerabilities in its QuickTime media player software, all of which can be used to execute arbitrary code on vulnerable machines. Several of the flaws are buffer overflows, and users who still run QuickTime should update it as soon as possible.

The patch for QuickTime is for Windows machines running XP SP2 or later, Vista or Windows 7. The fixes repair a number of critical holes in QuickTime, Apple’s software for playing videos and other content. Many of the flaws fixed in the new version of the software can be triggered by exploits that are contained either in malicious movie files or hosted on malicious Web sites.

Here’s the list of the vulnerabilities fixed in Apple’s patch release:

  • QuickTime

    Available for: Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution

    Description: A buffer overflow existed in the handling of REGION records in PICT files. This issue was addressed through improved bounds checking.

    CVE-ID

    CVE-2011-1374 : Mark Yason of the IBM X-Force

  • QuickTime

    Available for: Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue existed in the handling of PICT files. This issue was addressed through improved bounds checking.

    CVE-ID

    CVE-2012-3757 : Jeremy Brown at Microsoft and Microsoft Vulnerability Research (MSVR)

  • QuickTime

    Available for: Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: A use after free issue existed in the QuickTime plugin’s handling of ‘_qtactivex_’ parameters within a HTML object element. This issue was addressed through improved memory handling.

    CVE-ID

    CVE-2012-3751 : chkr_d591 working with iDefense VCP

  • QuickTime

    Available for: Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution

    Description: A buffer overflow existed in the handling of the transform attribute in text3GTrack elements. This issue was addressed through improved bounds checking.

    CVE-ID

    CVE-2012-3758 : Alexander Gavrun working with HP TippingPoint’s Zero Day Initiative

  • QuickTime

    Available for: Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution

    Description: Multiple buffer overflows existed in the handling of style elements in QuickTime TeXML files. These issues were addressed through improved bounds checking.

    CVE-ID

    CVE-2012-3752 : Arezou Hosseinzad-Amirkhizi, Vulnerability Research Team, TELUS Security Labs

  • QuickTime

    Available for: Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: A buffer overflow existed in the QuickTime plugin’s handling of MIME types. This issue was addressed through improved bounds checking.

    CVE-ID

    CVE-2012-3753 : Pavel Polischouk, Vulnerability Research Team, TELUS Security Labs

  • QuickTime

    Available for: Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: A use after free issue existed in the QuickTime ActiveX control’s handling of the Clear() method. This issue was addressed through improved memory management.

    CVE-ID

    CVE-2012-3754 : CHkr_d591 working with iDefense VCP

  • QuickTime

    Available for: Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted Targa file may lead to an unexpected application termination or arbitrary code execution

    Description: A buffer overflow existed in the handling of Targa image files. This issue was addressed through improved bounds checking.

    CVE-ID

    CVE-2012-3755 : Senator of Pirates

  • QuickTime

Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of ‘rnet’ boxes in MP4 files. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2012-3756 : Kevin Szkudlapski of QuarksLab

Suggested articles

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.