CVE-2008-3624

CVE-2008-3624 describes a heap-based buffer overflow in Apple QuickTime before 7.5.5 triggered by crafted QTVR panorama atoms in QuickTime movie files. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (application crash). Affected product is QuickTi...

CVE-2008-3614

Integer overflow in Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted PICT image, which triggers heap corruption...

CVE-2008-3626

Apple QuickTime prior to 7.5.5 is affected by a memory-corruption vulnerability in CallComponentFunctionWithStorage when handling large entries in the STSZ atoms’ sample_size_table. A crafted movie file can allow remote attackers to execute arbitrary code or cause a denial of service. The issue a...

CVE-2008-3625

Apple QuickTime before 7.5.5 is affected by a stack-based buffer overflow in the PDAT atom of QuickTime VR (QTVR) files, triggered by crafted panorama track elements (maxTilt, minFieldOfView, maxFieldOfView). Exploitation can lead to remote code execution or a denial of service. Remediation: upgr...

CVE-2008-3624: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a QuickTime Virtual Reality QTVR movie file with crafted panorama atoms...

ZDI-08-062: Apple QuickTime MDAT Frame Parsing Memory Corruption Vulnerability

ZDI-08-062: Apple QuickTime MDAT Frame Parsing Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-062 September 9, 2008 -- CVE ID: CVE-2008-3627 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- Vulnerability Details: This vulnerability allows...

ZDI-08-059: Apple QuickTime STSZ Atom Parsing Heap Corruption Vulnerability

ZDI-08-059: Apple QuickTime STSZ Atom Parsing Heap Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-059 September 9, 2008 -- CVE ID: CVE-2008-3626 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPointTM IPS Customer Protection: TippingPoint IP...

ZDI-08-061: Apple QuickTime Player H.264 Parsing Heap Corruption Vulnerability

ZDI-08-061: Apple QuickTime Player H.264 Parsing Heap Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-061 September 9, 2008 -- CVE ID: CVE-2008-3627 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- Vulnerability Details: This vulnerability allows...

ZDI-08-060: Apple QuickTime AVC1 Atom Parsing Heap Overflow Vulnerability

ZDI-08-060: Apple QuickTime AVC1 Atom Parsing Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-060 September 9, 2008 -- CVE ID: CVE-2008-3627 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

CVE-2008-3615: Undefined Security Weakness

ir5032.qtx in an unspecified third-party Indeo v5 codec for QuickTime, when used with Apple QuickTime before 7.5.5 on Windows, accesses uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted movie file...

QuickTime < 7.5.5 Multiple Vulnerabilities (Windows)

The version of QuickTime installed on the remote Windows host is older than 7.5.5. Such versions contain several vulnerabilities : - An integer overflow in QuickTime's handling of PICT images may lead to an application crash or arbitrary code execution CVE-2008-3614. - An uninitialized memory...

iDefense Security Advisory 09.09.08: Apple QuickTime PICT Integer Overflow Vulnerability

iDefense Security Advisory 09.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Sep 09, 2008 I. BACKGROUND Quicktime is Apple's media player product, and is used to render video and other media. The PICT file format was developed by Apple Inc. in 1984. PICT files can contain both objec...

CVE-2008-3629: Undefined Security Weakness

Apple QuickTime before 7.5.5 allows remote attackers to cause a denial of service application crash via a crafted PICT image that triggers an out-of-bounds read...

CVE-2008-3627: Undefined Security Weakness

Apple QuickTime before 7.5.5 does not properly handle 1 MDAT atoms in MP4 video files within QuickTimeH264.qtx, 2 MDAT atoms in mov video files within QuickTimeH264.scalar, and 3 AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrar...

CVE-2008-3625: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a QuickTime Virtual Reality QTVR movie file with crafted 1 maxTilt, 2 minFieldOfView, and 3 maxFieldOfView elements in panorama track PD...

QuickTime < 7.5.5 Multiple Vulnerabilities (Mac OS X)

The version of QuickTime installed on the remote Mac OS X host is older than 7.5.5. Such versions contain several vulnerabilities : - Heap and stack-based buffer overflows in the handling of panorama atoms in QTVR QuickTime Virtual Reality movie files could lead to an application crash or arbitra...

ZDI-08-058: Apple QuickTime Panorama PDAT Atom Parsing Buffer Overflow Vulnerability

ZDI-08-058: Apple QuickTime Panorama PDAT Atom Parsing Buffer Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-058 September 9, 2008 -- CVE ID: CVE-2008-3625 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPointTM IPS Customer Protection:...

CVE-2008-3614: Undefined Security Weakness

Integer overflow in Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted PICT image, which triggers heap corruption...

CVE-2008-3628: Undefined Security Weakness

Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted PICT image, related to an "invalid pointer issue."...

CVE-2008-3626: Improper Restriction of Operations within the Bounds of a Memory Buffer

The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the samplesizetable in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted mov...