[Full-disclosure] iDefense Security Advisory 07.11.07: Apple QuickTime SMIL File Processing Integer Overflow Vulnerability

Apple QuickTime SMIL File Processing Integer Overflow Vulnerability iDefense Security Advisory 07.11.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 11, 2007 I. BACKGROUND QuickTime is Apple's media player product used to render video and other media. For more information visit...

Apple QuickTime fails to properly handle malformed movie files

Overview Apple QuickTime fails to properly handle malformed movie files. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition. Description Apple QuickTime is multimedia software that allows users to view local and remote...

Apple QuickTime 7.1.5 - Information Disclosure Multiple Code Execution Vulnerabilities

Apple QuickTime 7.1.5 - Information Disclosure Multiple Code Execution Vulnerabilities source: https://www.securityfocus.com/bid/24873/info Apple QuickTime is prone to an information-disclosure and multiple remote code-execution vulnerabilities. Remote attackers may exploit these issues by entici...

Apple Quicktime For Java远程堆溢出漏洞

Apple QuickTime是一款流行的多媒体播放器，支持多种媒体格式。 QuickTime的实现上存在漏洞，远程攻击者可能利用此漏洞控制用户机器。 QuickTime for Java可能允许在所分配的堆之外实例化或操作对象。漏洞起因是QTObject的子类没有正确设置安全限制，不可信任的Java代码允许将调用QTJava.dll中不安全函数的QuickTime对象归为子类，导致读写任意内存。如果用户受骗访问了包含有特制Java Applet的Web页面的话，就可能触发堆溢出，导致执行任意指令。 Apple QuickTime Player 7.1.6...

Apple QuickTime for Java security bypass vulnerability

Overview Apple QuickTime for Java fails to properly restrict the instantiation and manipulation of Java objects. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Apple QuickTime includes the ability to integrate QuickTim...

Apple QuickTime for Java information disclosure vulnerability

Overview Apple QuickTime for Java fails to properly clear memory. As a result, sensitive information may be exposed to unintended parties. Description Apple QuickTime includes the ability to integrate QuickTime into Java applications and applets. This feature is known as QuickTime for Java. Apple...

Code injection

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not clear potentially sensitive memory before use, which allows remote attackers to read memory from a web browser via unknown vectors related to Java applets...

CVE-2007-2388

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory location...

CVE-2007-2389

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not clear potentially sensitive memory before use, which allows remote attackers to read memory from a web browser via unknown vectors related to Java applets...

CVE-2007-2389

CVE-2007-2389 concerns Apple QuickTime for Java 7.1.6 on Mac OS X and Windows. The root cause is that QuickTime for Java does not clear memory before use, potentially allowing a remote attacker to read memory from a web browser via Java applets. Impact is memory disclosure from the browser contex...

CVE-2007-2388

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory location...

CVE-2007-2388

CVE-2007-2388 affects Apple QuickTime for Java 7.1.6 on Mac OS X and Windows. The vulnerability arises from improper restriction of QTObject subclassing, allowing a remote attacker to execute arbitrary code via a web page that uses a user-defined class accessing unsafe functions to write to arbit...

CVE-2007-2389

Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not clear potentially sensitive memory before use, which allows remote attackers to read memory from a web browser via unknown vectors related to Java applets...

Apple QuickTime Crafted Media File FlipFileTypeAtom_BtoN Integer Underflow (CVE-2007-2296)

MP4 is the official filename extension for MPEG-4 Part 14 files.These files are generally used to store digital audio and digital video streams.A vulnerability has been reported in Apple QuickTime. A remote attacker could trigger this vulnerability via a specially crafted MP4 file. Successful...

Heap overflow

Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted Sample Table Sample Descriptor STSD atom size in a QuickTime movie...

CVE-2007-0754

Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted Sample Table Sample Descriptor STSD atom size in a QuickTime movie...

CVE-2007-0754

Apple QuickTime before 7.1.3 is affected by a heap-based buffer overflow in the STSD atom size parsing, allowing user-assisted remote code execution via a crafted QuickTime movie. The issue is tied to the STSD parsing path in QuickTime; vendor patch available in QuickTime 7.1.3. If not upgrading,...

TPTI-07-07: Apple QuickTime STSD Parsing Heap Overflow Vulnerability

TPTI-07-07: Apple QuickTime STSD Parsing Heap Overflow Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-07-07 May 10, 2007 -- CVE ID: CVE-2007-0754 -- Affected Vendor: Apple -- Affected Products: QuickTime Player 7.x -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers...

Apple QuickTime for Java QTPointerRef heap memory corruption vulnerability

Overview Apple QuickTime for Java contains a heap memory corruption vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Apple QuickTime includes the ability to integrate QuickTime into Java applications and applets. This...

Apple QTJava toQTPointer() Pointer Arithmetic Memory Overwrite Vulnerability

This vulnerability allows attackers to execute arbitrary code on systems with vulnerable installations of Apple's QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The flaw exists within the QuickTime Java extensions QTJava.dll,...