Summary
This host is installed with Apple QuickTime and is prone to multiple vulnerabilities.
Impact
Successful exploitation could allow attackers to execute arbitrary code or cause a denial of service.
Impact Level: System/Application
Solution
Upgrade to QuickTime Player version 7.7.2 or later, For updates refer to http://support.apple.com/downloads/
Insight
The flaws are due to
- Errors within the handling of TeXML files.
- An error when handling of text tracks and MPEG files and sean atoms.
- An error while handling RLE, JPEG2000, H.264 and Sorenson encoded movie files.
- An error exists within the parsing of MP4 encoded files and .pict files.
- An off-by-one error can be exploited to cause a single byte buffer overflow.
- An error when handling audio samples.
- An error within the plugin's handling of QTMovie objects.
- An error when parsing the MediaVideo header in videos encoded with the PNG format.
- A signedness error within the handling of QTVR movie files.
- A boundary error in QuickTime.qts when extending a file path based on its short path.
Affected
QuickTime Player version prior to 7.7.2 on Windows
References
Severity
Classification
-
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Adobe Acrobat Multiple Vulnerabilities - 01 Jan14 (Windows)
- Adobe AIR Multiple Vulnerabilities-01 Dec13 (Windows)
- Adobe Acrobat Multiple Unspecified Vulnerabilities -01 May13 (Windows)
- Adobe Flash Media Server Multiple Remote Security Vulnerabilities
- Adobe Acrobat Out-of-bounds Vulnerability Feb15 (Mac OS X)