Home / mailings APPLE-SA-2012-11-07-1 QuickTime 7.7.3
Posted on 08 November 2012
Apple Security-announce-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-11-07-1 QuickTime 7.7.3
QuickTime 7.7.3 is now available and addresses the following:
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted PICT file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of REGION
records in PICT files. This issue was addressed through improved
bounds checking.
CVE-ID
CVE-2011-1374 : Mark Yason of the IBM X-Force
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted PICT file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
PICT files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2012-3757 : Jeremy Brown at Microsoft and Microsoft Vulnerability
Research (MSVR)
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime
plugin's handling of '_qtactivex_' parameters within a HTML object
element. This issue was addressed through improved memory handling.
CVE-ID
CVE-2012-3751 : chkr_d591 working with iDefense VCP
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted QuickTime TeXML file may lead
to an unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of the
transform attribute in text3GTrack elements. This issue was addressed
through improved bounds checking.
CVE-ID
CVE-2012-3758 : Alexander Gavrun working with HP TippingPoint's Zero
Day Initiative
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted QuickTime TeXML file may lead
to an unexpected application termination or arbitrary code execution
Description: Multiple buffer overflows existed in the handling of
style elements in QuickTime TeXML files. These issues were addressed
through improved bounds checking.
CVE-ID
CVE-2012-3752 : Arezou Hosseinzad-Amirkhizi, Vulnerability Research
Team, TELUS Security Labs
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the QuickTime plugin's
handling of MIME types. This issue was addressed through improved
bounds checking.
CVE-ID
CVE-2012-3753 : Pavel Polischouk, Vulnerability Research Team, TELUS
Security Labs
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the QuickTime ActiveX
control's handling of the Clear() method. This issue was addressed
through improved memory management.
CVE-ID
CVE-2012-3754 : CHkr_d591 working with iDefense VCP
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted Targa file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of Targa
image files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2012-3755 : Senator of Pirates
QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'rnet'
boxes in MP4 files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2012-3756 : Kevin Szkudlapski of QuarksLab
QuickTime 7.7.3 may be obtained from the QuickTime Downloads site:
http://www.apple.com/quicktime/download/
The download file is named: "QuickTimeInstaller.exe"
Its SHA-1 digest is: 3123713755c0705babacf186f5c3571204ee3ae7
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
