New QuickTime fixes a number of security vulnerabilities
Posted on 09 November 2012.
Bookmark and Share
In a new security advisory, Apple addressed a number of vulnerabilities in QuickTime for Windows and announced a new version - 7.7.3. This is the list of security vulnerabilities fixed in this release.

Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of REGION records in PICT files. This issue was addressed through improved bounds checking.
CVE-2011-1374 : Mark Yason of the IBM X-Force

Impact: Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of PICT files. This issue was addressed through improved bounds checking.
CVE-2012-3757 : Jeremy Brown at Microsoft and Microsoft Vulnerability Research (MSVR)

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime plugin's handling of '_qtactivex_' parameters within a HTML object element. This issue was addressed through improved memory handling.
CVE-2012-3751 : chkr_d591 working with iDefense VCP

Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of the transform attribute in text3GTrack elements. This issue was addressed through improved bounds checking.
CVE-2012-3758 : Alexander Gavrun working with HP TippingPoint's Zero Day Initiative

Impact: Viewing a maliciously crafted QuickTime TeXML file may lead to an unexpected application termination or arbitrary code execution
Description: Multiple buffer overflows existed in the handling of style elements in QuickTime TeXML files. These issues were addressed through improved bounds checking.
CVE-2012-3752 : Arezou Hosseinzad-Amirkhizi, Vulnerability Research Team, TELUS Security Labs

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the QuickTime plugin's handling of MIME types. This issue was addressed through improved bounds checking.
CVE-2012-3753 : Pavel Polischouk, Vulnerability Research Team, TELUS
Security Labs

Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime ActiveX control's handling of the Clear() method. This issue was addressed through improved memory management.
CVE-2012-3754 : CHkr_d591 working with iDefense VCP

Impact: Viewing a maliciously crafted Targa file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of Targa image files. This issue was addressed through improved bounds checking.
CVE-2012-3755 : Senator of Pirates

Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'rnet'
boxes in MP4 files. This issue was addressed through improved bounds checking.
CVE-2012-3756 : Kevin Szkudlapski of QuarksLab





Spotlight

Nine patterns make up 92 percent of security incidents

Posted on 23 April 2014.  |  Researchers have found that 92 percent of the 100,000 security incidents analyzed over the past ten years can be traced to nine basic attack patterns that vary from industry to industry.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Apr 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //