New QuickTime fixes a number of security vulnerabilities
Posted on 09 November 2012.
Bookmark and Share
In a new security advisory, Apple addressed a number of vulnerabilities in QuickTime for Windows and announced a new version - 7.7.3. This is the list of security vulnerabilities fixed in this release.

Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of REGION records in PICT files. This issue was addressed through improved bounds checking.
CVE-2011-1374 : Mark Yason of the IBM X-Force

Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of PICT files. This issue was addressed through improved bounds checking.
CVE-2012-3757 : Jeremy Brown at Microsoft and Microsoft Vulnerability Research (MSVR)

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime plugin's handling of '_qtactivex_' parameters within a HTML object element. This issue was addressed through improved memory handling.
CVE-2012-3751 : chkr_d591 working with iDefense VCP

Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of the transform attribute in text3GTrack elements. This issue was addressed through improved bounds checking.
CVE-2012-3758 : Alexander Gavrun working with HP TippingPoint's Zero Day Initiative

Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution
Description: Multiple buffer overflows existed in the handling of style elements in QuickTime TeXML files. These issues were addressed through improved bounds checking.
CVE-2012-3752 : Arezou Hosseinzad-Amirkhizi, Vulnerability Research Team, TELUS Security Labs

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the QuickTime plugin's handling of MIME types. This issue was addressed through improved bounds checking.
CVE-2012-3753 : Pavel Polischouk, Vulnerability Research Team, TELUS
Security Labs

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime ActiveX control's handling of the Clear() method. This issue was addressed through improved memory management.
CVE-2012-3754 : CHkr_d591 working with iDefense VCP

Impact: Viewing a maliciously crafted Targa file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of Targa image files. This issue was addressed through improved bounds checking.
CVE-2012-3755 : Senator of Pirates

Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'rnet'
boxes in MP4 files. This issue was addressed through improved bounds checking.
CVE-2012-3756 : Kevin Szkudlapski of QuarksLab





Spotlight

Attackers use reflection techniques for larger DDoS attacks

Posted on 17 April 2014.  |  Instead of using a network of zombie computers, newer DDoS toolkits abuse Internet protocols that are available on open or vulnerable servers and devices. This approach can lead to the Internet becoming a ready-to-use botnet for malicious actors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Apr 18th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //