About the security content of QuickTime 7.6

This document describes the security content of QuickTime 7.6, which can be downloaded and installed via Software Update preferences, or from Apple Downloads.

For the protection of our customers, Apple does not disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To find out more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To find out more about other Security Updates, see “Apple Security Updates”.

QuickTime 7.6

• QuickTime

  CVE-ID: CVE-2009-0001

  Available for: Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 and SP3

  Impact: accessing a maliciously crafted RTSP URL may lead to an unexpected application termination or arbitrary code execution

  Description: a heap buffer overflow exists in QuickTime’s handling of RTSP URLs. Accessing a maliciously crafted RTSP URL may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of RTSP URLs. Credit to Attila Suszter for reporting this issue.

• QuickTime

  CVE-ID: CVE-2009-0002

  Available for: Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 and SP3

  Impact: viewing a maliciously crafted QTVR movie file may lead to an unexpected application termination or arbitrary code execution

  Description: a heap buffer overflow exists in QuickTime’s handling of THKD atoms in QTVR (QuickTime Virtual Reality) movie files. Viewing a maliciously crafted QTVR file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to an anonymous researcher working with TippingPoint's Zero Day Initiative for reporting this issue.

• QuickTime

  CVE-ID: CVE-2009-0003

  Available for: Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2

  Impact: viewing a maliciously crafted AVI movie file may lead to an unexpected application termination or arbitrary code execution

  Description: a heap buffer overflow may occur while processing an AVI movie file. Opening a maliciously crafted AVI movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to an anonymous researcher working with TippingPoint's Zero Day Initiative for reporting this issue.

• QuickTime

  CVE-ID: CVE-2009-0004

  Available for: Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 and SP3

  Impact: viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

  Description: a buffer overflow exists in the handling of MPEG-2 video files with MP3 audio content. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Chad Dougherty of the CERT Coordination Center for reporting this issue.

• QuickTime

  CVE-ID: CVE-2009-0005

  Available for: Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 and SP3

  Impact: viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

  Description: a memory corruption exists in QuickTime’s handling of H.263 encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of H.263 encoded movie files. Credit to Dave Soldera of NGS Software for reporting this issue.

• QuickTime

  CVE-ID: CVE-2009-0006

  Available for: Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 and SP3

  Impact: viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

  Description: a signedness issue exists in QuickTime’s handling of Cinepak encoded movie files, which may result in a heap buffer overflow. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of movie files. Credit to an anonymous researcher working with TippingPoint's Zero Day Initiative for reporting this issue.

• QuickTime

  CVE-ID: CVE-2009-0007

  Available for: Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2 and SP3

  Impact: viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

  Description: a heap buffer overflow exists in QuickTime’s handling of jpeg atoms in QuickTime movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to an anonymous researcher working with the TippingPoint Zero Day Initiative for reporting this issue.