Apple QuickTime Player 7.5修复多个安全漏洞

BUGTRAQ ID: 29619 CVECAN ID: CVE-2008-1581,CVE-2008-1582,CVE-2008-1583,CVE-2008-1584,CVE-2008-1585 Apple QuickTime是一款非常流行的多媒体播放器。 QuickTime的7.5之前版本存在多个安全漏洞，允许用户通过畸形的媒体文件获得敏感信息或完全入侵用户系统。 CVE-2008-1581 QuickTime在处理PICT图形中的PixData结构时存在堆溢出漏洞，如果用户受骗打开了恶意的PICT图形的话就会导致播放器终止或执行任意指令。 CVE-2008-1582...

Apple QuickTime buffer overflow

Buffer overflow on PICT images, INDEO video parsing...

US-CERT Technical Cyber Security Alert TA08-162C -- Apple Quicktime Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-162C Apple Quicktime Updates for Multiple Vulnerabilities Original release date: June 10, 2008 Last revised: -- Source: US-CERT Systems Affected Apple Mac OS X running versions of QuickTi...

CVE-2008-1581

Heap-based buffer overflow in Apple QuickTime before 7.5 on Windows allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted packed scanlines in PixData structures in a PICT image...

Code injection

Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file...

Memory corruption

Unspecified vulnerability in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted AAC-encoded file that triggers memory corruption...

CVE-2008-1582

Unspecified vulnerability in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted AAC-encoded file that triggers memory corruption...

Heap overflow

Heap-based buffer overflow in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PICT image, a different vulnerability than CVE-2008-1581...

CVE-2008-1585

Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file...

CVE-2008-1583

Heap-based buffer overflow in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PICT image, a different vulnerability than CVE-2008-1581...

CVE-2008-1584

Stack-based buffer overflow in Indeo.qtx in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service crash or execute arbitrary code via crafted Indeo video codec content in a movie file...

Heap overflow

Heap-based buffer overflow in Apple QuickTime before 7.5 on Windows allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted packed scanlines in PixData structures in a PICT image...

CVE-2008-1584

Apple QuickTime before 7.5 is affected by a stack-based buffer overflow in Indeo.qtx when parsing Indeo video content, allowing remote attackers to crash the player or execute arbitrary code via crafted movie files. The vulnerability stems from inadequate bounds checking in Indeo.qtx. Affected pr...

CVE-2008-1584

Stack-based buffer overflow in Indeo.qtx in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service crash or execute arbitrary code via crafted Indeo video codec content in a movie file...

CVE-2008-1585

CVE-2008-1585 concerns Apple QuickTime

CVE-2008-1583

CVE-2008-1583 relates to Apple QuickTime before 7.5, where a heap-based buffer overflow occurs while processing PICT images. The vulnerability arises in the PixData handling, enabling remote attackers to crash the player and potentially execute arbitrary code. Public records in the provided docum...

CVE-2008-1582

Apple QuickTime before 7.5 contains a memory corruption vulnerability in handling AAC-encoded media, allowing remote attackers to crash the player and potentially execute arbitrary code by opening a crafted AAC file. This CVE (CVE-2008-1582) is part of a set of related issues affecting QuickTime

CVE-2008-1581

Heap-based buffer overflow in Apple QuickTime before 7.5 on Windows allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted packed scanlines in PixData structures in a PICT image...

CVE-2008-1582

Unspecified vulnerability in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted AAC-encoded file that triggers memory corruption...

CVE-2008-1585

Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file...