Apple Patches Eight QuickTime Flaws

Apple released an update to its QuickTime media player on Friday, patching eight security flaws in the application including code execution and information disclosure risks. Both Mac OS X and Windows are affected.

The first four flaws involve specially crafted H.264, movie, .m4v, or SMIL files that could lead to an unexpected application termination and/or arbitary code execution. The first two involve a memory corruption issue, while the latter two are caused by integer overflow vulnerabilities.

In all cases, Apple has fixed the problem by forcing QuickTime to perform additional validation of files before allowing them to play.

The last four fixes address various flaws within QuickTime for Java that would allow for arbitrary code to be executed by visiting a malicious Web site. The first of these could allow for security checks to be disabled, while another may allow an attacker to bypass those checks.

Attackers could capture a client's screen content in another flaw, while the final Java flaw involves JDIrect. To fix these issues, Apple has implemented additional validation checks for Java applets, while also removing support for JDirect from QuickTime for Java.

In the screen content disclosure flaw, Apple says it has fixed QuickTime for Java by having it perform a "more accurate" access control check.

The update is available for Mac OS X 10.3.9, Mac OS X 10.4.9 or later, as well as Windows XP SP2 and Vista.