Skip to content

December 8, 2010

Apple Releases QuickTime 7.6.9 Security Update

Apple has released QuickTime 7.6.9 for Leopard 10.5.8 and Windows (XP,V,7), patching a number of vulnerabilities including several that were fixed in the recent 10.6.5 update.

The vulnerabilities include improper handling of JP2, AVI, MPEG, Flashpix, GIF, PICT, and QTVR files. Viewing maliciously-crafted files can lead to remote code execution in some cases.

QuickTime definitely needs more strengthening. Leopard and Windows users, go forth and patch!

QuickTime 7.6.9

  • QuickTimeCVE-ID: CVE-2010-3787Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution

    Description: A heap buffer overflow exists in QuickTime’s handling of JP2 images. Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to Nils of MWR InfoSecurity, and Will Dormann of the CERT/CC, for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3788Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution

    Description: An uninitialized memory access issue exists in QuickTime’s handling of JP2 images. Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of JP2 images. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to Damian Put and Procyun, working with TippingPoint’s Zero Day Initiative for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3789Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted avi file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue is in QuickTime’s handling of avi files. Viewing a maliciously crafted avi file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of avi files. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to Damian Put working with TippingPoint’s Zero Day Initiative for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3790Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue exists in QuickTime’s handling of movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of movie files. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to Honggang Ren of Fortinet’s FortiGuard Labs for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3791Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

    Description: A buffer overflow exists in QuickTime’s handling of MPEG encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to an anonymous researcher working with TippingPoint’s Zero Day Initiative for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3792Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

    Description: A signedness issue exists in QuickTime’s handling of MPEG encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of MPEG encoded movie files. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to an anonymous researcher working with TippingPoint’s Zero Day Initiative for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3793Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue exists in QuickTime’s handling of Sorenson encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of Sorenson encoded movie files. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to an anonymous researcher working with TippingPoint’s Zero Day Initiative, and Carsten Eiram of Secunia Research for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3794Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution

    Description: An uninitialized memory access issue exists in QuickTime’s handling of FlashPix images. Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to an anonymous researcher working with TippingPoint’s Zero Day Initiative for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3795Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted GIF image may lead to an unexpected application termination or arbitrary code execution

    Description: An uninitialized memory access issue exists in QuickTime’s handling of GIF images. Viewing a maliciously crafted GIF image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.5. Credit to an anonymous researcher working with TippingPoint’s Zero Day Initiative for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3800Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue exists in QuickTime’s handling of PICT files. Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of PICT files. Credit to Moritz Jodeit of n.runs AG and Damian Put, working with TippingPoint’s Zero Day Initiative, and Hossein Lotfi (s0lute), working with VeriSign iDefense Labs for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3801Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue exists in QuickTime’s handling of FlashPix images. Viewing a maliciously crafted FlashPix image may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management. Credit to Damian Put working with TippingPoint’s Zero Day Initiative, and Rodrigo Rubira Branco from the Check Point Vulnerability Discovery Team for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-3802Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted QTVR movie file may lead to an unexpected application termination or arbitrary code execution

    Description: A memory corruption issue exists in QuickTime’s handling of panorama atoms in QTVR (QuickTime Virtual Reality) movie files. Viewing a maliciously crafted QTVR movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of QTVR movie files. Credit to an anonymous researcher working with TippingPoint’s Zero Day Initiative for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-1508Available for: Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

    Description: A heap buffer overflow exists in QuickTime’s handling of Track Header (tkhd) atoms. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking. This issue does not affect Mac OS X systems. Credit to Moritz Jodeit of n.runs AG, working with TippingPoint’s Zero Day Initiative, and Carsten Eiram of Secunia Research for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-0530Available for: Windows 7, Vista, XP SP2 or later

    Impact: A local user may have access to sensitive information

    Description: A filesystem permission issue exists in QuickTime. This may allow a local user to access the contents of the “Apple Computer” directory in the user’s profile, which may lead to the disclosure of sensitive information. This issue is addressed through improved filesystem permissions. This issue does not affect Mac OS X systems. Credit to Geoff Strickler of On-Line Transaction Consultants for reporting this issue.

  • QuickTimeCVE-ID: CVE-2010-4009Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Windows 7, Vista, XP SP2 or later

    Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

    Description: An integer overflow exists in QuickTime’s handling of movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking. Credit to Honggang Ren of Fortinet’s FortiGuard Labs for reporting this issue.

Related posts:

  1. Apple Releases Slew of Security Updates (OSX, Safari, iTunes, iOS 5, aTV)
  2. QuickTime Player SMIL Buffer Overflow and Metasploit Exploit
  3. Apple QuickTime 7.6.7 “_Marshaled_pUnk” Code Execution Vulnerability and Metasploit Exploit
  4. Apple Releases Safari 5.0.3 and 4.1.3
  5. Safari Errorjacking Vulnerability and Exploit [Patched]
Read more from Security, Mac OS X, Updates, Vulnerabilities, Windows
, , , , , , , ,

Share your thoughts, post a comment.

(required)
(required)

Note: HTML is allowed. Your email address will never be published.

Subscribe to comments

css.php