.png)
(LiveHacking.Com) - Apple has released QuickTime 7.7.1 for Windows to fix multiple vulnerabilities that if exploited could allow an attacker to execute arbitrary code, cause a denial-of-service condition, or obtain sensitive information.
According to the security advisory, QuickTime 7.7.1 for Windows 7, Vista and XP, fixes several issues which have either been fixed in OS X (with OS X Lion v10.7.2 or with Security Update 2011-006 for
OS X v10.6 systems) or don’t affect Mac OS X systems.
The problems fixed are:
- A buffer overflow existed in QuickTime’s handling of H.264 encoded movie files.
- An uninitialized memory access issue existed in QuickTime’s handling of URL data handlers within movie files.
- An implementation issue existed in QuickTime’s handling of the atom hierarchy within a movie file.
- A cross-site scripting issue existed in QuickTime Player’s “Save for Web” export. The template HTML files generated by this feature referenced a script file from a non-encrypted origin. An attacker in a privileged network position may be able to inject malicious scripts in the local domain if the user views a template file locally. This issue is addressed by removing the reference to an online script.
- A buffer overflow existed in QuickTime’s handling of FlashPix files.
- A buffer overflow existed in QuickTime’s handling of FLIC files.
- Multiple memory corruption issues existed in QuickTime’s handling of movie files.
- An integer overflow issue existed in the handling of PICT files.
- A signedness issue existed in the handling of font tables embedded in QuickTime movie files.
- A buffer overflow issue existed in the handling of FLC encoded movie files.
- An integer overflow issue existed in the handling of JPEG2000 encoded movie files.
- A memory corruption issue existed in the handling of TKHD atoms in QuickTime movie files.
To exploit most of the these vulnerabilities an attacker would need to create a special crafted movie file and get the victim to watch it on their PC.
.png)