About the security content of QuickTime MPEG-2 Playback Component

This document describes the security content of QuickTime MPEG-2 Playback Component.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates."

QuickTime MPEG-2 Playback Component

• QuickTime MPEG-2 Playback Component for Windows

  CVE-ID: CVE-2009-0008

  Available for: Windows Vista, XP SP2 and SP3

  Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution

  Description: An input validation issue exists in the QuickTime MPEG-2 Playback Component for Windows. Accessing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of MPEG-2 files. This issue does not affect systems running Mac OS X. Credit to Richard Lemon of Code Lemon for reporting this issue.

  The QuickTime MPEG-2 Playback Component is not installed by default, and is provided separately from QuickTime. Details are available via http://www.apple.com/quicktime/mpeg2/ . If you paid for and downloaded an earlier version of the QuickTime MPEG-2 Playback Component from the Apple Store, you may download the updated version for free.

  The steps to determine that a system has the updated version are listed here. The version number of the updated QuickTime MPEG-2 Playback Component for Windows is 7.60.92.0.