US-CERT Technical Cyber Security Alert TA08-016A -- Apple QuickTime Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-016A Apple QuickTime Updates for Multiple Vulnerabilities Original release date: January 16, 2008 Last revised: -- Source: US-CERT Systems Affected Apple Mac OS X running versions of...

CVE-2008-0036

Buffer overflow in Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, which triggers the overflow during decoding...

Design/Logic Flaw

Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a movie file containing a Macintosh Resource record with a modified length value in the resource header, which triggers heap corruption...

Buffer overflow

Buffer overflow in Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, which triggers the overflow during decoding...

Memory corruption

Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service application termination and execute arbitrary code via a movie file with Image Descriptor IDSC atoms containing an invalid atom size, which triggers memory corruption...

CVE-2008-0032

Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a movie file containing a Macintosh Resource record with a modified length value in the resource header, which triggers heap corruption...

CVE-2008-0033

Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service application termination and execute arbitrary code via a movie file with Image Descriptor IDSC atoms containing an invalid atom size, which triggers memory corruption...

CVE-2008-0031

Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service application termination and execute arbitrary code via a crafted Sorenson 3 video file, which triggers memory corruption...

CVE-2008-0036

CVE-2008-0036 : Buffer overflow in Apple QuickTime prior to 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, triggering during decoding. Affected software: Apple QuickTime before 7.4. Root cause: overflow during decoding of the crafted PICT data. Impact i...

CVE-2008-0036

Buffer overflow in Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, which triggers the overflow during decoding...

CVE-2008-0032

Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a movie file containing a Macintosh Resource record with a modified length value in the resource header, which triggers heap corruption...

CVE-2008-0032

Apple QuickTime before 7.4 is affected by CVE-2008-0032 due to a heap corruption vulnerability in processing Macintosh Resources embedded in QuickTime movie files. The issue arises from a modified length value in the resource header of a Macintosh Resource record, enabling remote attackers to tri...

Memory corruption

Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service application termination and execute arbitrary code via a crafted Sorenson 3 video file, which triggers memory corruption...

CVE-2008-0033

Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service application termination and execute arbitrary code via a movie file with Image Descriptor IDSC atoms containing an invalid atom size, which triggers memory corruption...

CVE-2008-0033

Summary: CVE-2008-0033 affects Apple QuickTime prior to 7.4. The vulnerability resides in parsing of Image Descriptor (IDSC) atoms within QTIF image files, where specifying a malicious atom size can trigger an under- or mis-allocated heap condition, resulting in memory corruption. This can lead t...

CVE-2008-0031

CVE-2008-0031 affects Apple QuickTime before 7.4. A crafted Sorenson 3 video file can trigger memory corruption, enabling remote denial of service and arbitrary code execution. Impact is via parsing the video stream; exploitation details are described in the connected sources. remediation: upgrad...

CVE-2008-0031

Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service application termination and execute arbitrary code via a crafted Sorenson 3 video file, which triggers memory corruption...

[Full-disclosure] iDefense Security Advisory 01.15.08: Apple QuickTime Macintosh Resource Processing Heap Corruption Vulnerability

iDefense Security Advisory 01.15.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 15, 2008 I. BACKGROUND Quicktime is Apple's media player product, and is used to render video and other media. For more information visit the vendor's web site at the following URL...

QuickTime < 7.4 Multiple Vulnerabilities (Windows)

The version of QuickTime installed on the remote Windows host is older than 7.4. Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially crafted movie or PICT file file with QuickTime. C...

QuickTime < 7.4 Multiple Vulnerabilities (Mac OS X)

The version of QuickTime installed on the remote Mac OS X host is older than 7.4. Such versions contain several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host if he can trick the user to open a specially crafted movie or PICT file file with QuickTime. C...