Languages

Archived - About Security Update (QuickTime 7.1.6)

This article has been archived and is no longer updated by Apple.

This document describes Security Update (QuickTime 7.1.6), which can be downloaded and installed via Software Update preferences, or from Apple Downloads.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates."

Security Update (QuickTime 7.1.6)

  • QuickTime

    CVE-ID: CVE-2007-2388

    Available for: QuickTime 7.1.6 for Mac OS X and Windows

    Impact: Visiting a malicious website may lead to arbitrary code execution

    Description: An implementation issue exists in QuickTime for Java, which may allow instantiation or manipulation of objects outside the bounds of the allocated heap. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of Java applets. Credit to John McDonald, Paul Griswold, and Tom Cross of IBM Internet Security Systems X-Force, and Dyon Balding of Secunia Research for reporting this issue.

  • QuickTime

    CVE-ID: CVE-2007-2389

    Available for: QuickTime 7.1.6 for Mac OS X and Windows

    Impact: Visiting a malicious website may lead to the disclosure of sensitive information

    Description: A design issue exists in QuickTime for Java, which may allow a web browser's memory to be read by a Java applet. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to the disclosure of sensitive information. This update addresses the issue by clearing memory before allowing it to be used by untrusted Java applets.

Last Modified: Feb 20, 2012
  • Last Modified: Feb 20, 2012
  • Article: TA24733
  • Views:

    2847

Additional Product Support Information