27 Oct 2011
06 Jan 2012
Apple QuickTime 7.x
This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.
Cross-Site Scripting vulnerabilities allow a third party to manipulate the content or behaviour of a web application in a user's browser, without compromising the underlying system.
Different Cross-Site Scripting related vulnerabilities are also classified under this category, including "script insertion" and "cross-site request forgery".
Cross-Site Scripting vulnerabilities are often used against specific users of a website to steal their credentials or to conduct spoofing attacks.
Exposure of sensitive information
Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.
Multiple vulnerabilities have been reported in Apple Quicktime, which can be exploited by malicious people to compromise a user's system.
1) An integer overflow error when handling PICT files can be exploited via a specially crafted .pict file.
2) A signedness error when parsing font names embedded within an atom in RLE encoded samples can be exploited to cause a buffer overflow via a specially crafted movie file.
3) An error when handling FLC Delta Decompression blocks in FLIC files can be exploited to cause a buffer overflow via a specially crafted file.
4) An integer overflow error when processing the Coding Style Default (COD) marker segment can be exploited to cause a buffer overflow via a specially crafted JPEG2000 file.
5) An error when handling TKHD atoms within QuickTime movie files can be exploited to cause a buffer underflow via a specially crafted movie file.
Note: The vulnerabilities #1 and #5 do not affect Mac OS X versions.
Update to version 7.7.1.
1, 2, 4) Luigi Auriemma via ZDI.