Apple Quicktime Java处理任意代码执行漏洞

Apple QuickTime是一款流行的多媒体播放器，支持多种媒体格式。 QuickTime在处理Java时存在安全漏洞，如果用户通过启用了Java的浏览器（如Safari或Firefox）访问了恶意站点的话，就可能触发这个漏洞，导致执行任意指令。 Apple QuickTime Player = 7.1.5 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.apple.com...

CVE-2007-2295: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the JVTCompEncodeFrame function in Apple Quicktime 7.1.5 and other versions before 7.2 allows remote attackers to execute arbitrary code via a crafted H.264 MOV file...

CVE-2007-2296: Undefined Security Weakness

Integer overflow in the FlipFileTypeAtomBtoN function in Apple Quicktime 7.1.5, and other versions before 7.2, allows remote attackers to execute arbitrary code via a crafted M4V MP4 file...

CVE-2007-2175

Apple QuickTime Java extensions QTJava.dll, as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating...

CVE-2007-2175

Apple QuickTime for Java (QTJava.dll) contains a heap memory corruption vulnerability in the toQTPointer function of QTHandleRef that can allow a remote, unauthenticated attacker to execute arbitrary code when Java is enabled in a browser (as demonstrated at CanSecWest 2007). The issue affects Qu...

CVE-2007-2175: Undefined Security Weakness

Apple QuickTime Java extensions QTJava.dll, as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating...

Apple QuickTime多个远程缓冲区溢出漏洞

Apple QuickTime是一款流行的多媒体播放器，支持多种媒体格式。 QuickTime在处理各种媒体格式时存在多个缓冲区溢出漏洞，远程攻击者可能利用这些漏洞通过诱使用户打开处理畸形媒体文件控制用户机器。 具体条目如下： QuickTime处理3GP视频文件时存在整数溢出。如果用户受骗打开了恶意的电影的话，就会触发这个溢出，导致拒绝服务或执行任意代码。（CVE-2007-0711） QuickTime处理MIDI文件时存在堆溢出。如果用户受骗打开了恶意的MIDI文件的话，就会触发这个溢出，导致拒绝服务或执行任意代码。（CVE-2007-0712）...

Apple Quicktime UDTA Parsing Heap Overflow Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple Quicktime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of forged...

[Full-disclosure] Apple QuickTime udta ATOM Integer Overflow

Apple QuickTime udta ATOM Integer Overflow By Sowhat of Nevis Labs Date: 2007.03.06 http://www.nevisnetworks.com http://secway.org/advisory/AD20070306.txt http://secway.org/advisory/AD20060512.txt CVE: CVE-2007-0714 Vendor: Apple Inc. Affected Versions: Apple QuickTime versions 7.1.5 Overview: We...

[Reversemode Advisory] Apple Quicktime Color ID remote heap corruption

APPLE QUICKTIME COLOR TABLE ID REMOTE HEAP CORRUPTION Rubйn Santamarta [email protected] Affected products and/or platforms: Mac OS X v10.3.9 and later Windows Vista Windows XP Windows 2000 Color table ID A 16-bit integer that identifies which color table to use. If this field is set to –1, t...

iDefense Security Advisory 03.05.07: Apple QuickTime Color Table ID Heap Corruption Vulnerability

Apple QuickTime Color Table ID Heap Corruption Vulnerability iDefense Security Advisory 03.05.07 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 05, 2007 I. BACKGROUND Quicktime is Apple's media player product used to render video and other media. For more information visit...

Apple QuickTime fails to properly process specially crafted MIDI files

Overview The Apple Quicktime player contains a heap buffer overflow vulnerability. This vulnerability may allow an attacker to execute arbitrary code or create a denial-of-service condition. Description Apple QuickTime contains a heap buffer overflow vulnerability. This vulnerability may allow an...

Apple QuickTime QTIF integer overflow

Overview A vulnerability in Apple QuickTime's handling of files in the QTIF format could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Apple's QuickTime is a player for files and streaming media in a variety of different formats, including QuickTime Image...

Apple QuickTime movie heap buffer overflow vulnerability

Overview The Apple QuickTime player contains a heap buffer overflow vulnerability. This vulnerability may allow an attacker to execute arbitrary code or create a denial-of-service condition. Description Apple QuickTime contains a heap buffer overflow vulnerability. This vulnerability may allow an...

Apple QuickTime UDTA atom integer overflow

Overview Apple QuickTime contains an integer overflow in handling UDTA atoms, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Apple QuickTime User Data UDTA Atoms allow a user to "... define and store data associated with a QuickTim...

Apple QuickTime QTIF stack buffer overflow

Overview A vulnerabilty in the way Apple QuickTime processes QTIF files may allow execution of arbitrary code. Description A vulnerability exists in the way Apple QuickTime handles specially crafted QuickTime Image QTIF files. According to Apple QuickTime 7.1.5 security document 305149:A stack...

Apple QuickTime 3GP integer overflow

Overview A vulnerabilty in the way Apple QuickTime processes 3GP files may allow execution of arbitrary code. Description A vulnerability exists in the way Apple QuickTime handles specially crafted 3GP files. According to Apple QuickTime 7.1.5 security document 305149:An integer overflow exists i...

Heap overflow

Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted QuickTime movie file...

Heap overflow

Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted MIDI file...

Integer overflow

Integer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted QuickTime movie with a User Data Atom UDTA with an Atom size field with a large value...