ZDI-10-038: Apple QuickTime QDMC/QDM2 Remote Code Execution Vulnerability

ZDI-10-038: Apple QuickTime QDMC/QDM2 Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-038 April 2, 2010 -- CVE ID: CVE-2010-0060 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

QuickTime < 7.6.6 Multiple Vulnerabilities (Mac OS X)

The version of QuickTime installed on the remote Mac OS X host is older than 7.6.6. Such versions contain several vulnerabilities : - A memory corruption issue in QuickTime's handling of QDM2 encoded audio content may lead to an application crash or arbitrary code execution. CVE-2010-0059 - A...

CVE-2010-0060

CoreAudio in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via crafted audio content with QDMC encoding...

CVE-2010-0060

CVE-2010-0060 affects Apple Mac OS X CoreAudio prior to 10.6.3, where parsing of crafted QDMC-encoded audio content can cause memory corruption and allow remote code execution or a denial of service. The vulnerability is tied to the QuickTime/CoreAudio pathway and can be triggered by a malformed ...