Apple QuickTime 7.7.1 video file Processing Integer Overflow Vulnerability

Release date: 2011-10-28
Updated on: 2011-10-28

Affected Systems:
Apple QuickTime Player 7.x
Unaffected system:
Apple QuickTime Player 7.7.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 50401
Cve id: CVE-2011-3250

QuickTime is a multimedia architecture developed by Apple Computer. It can process many digital videos, media paragraphs, sound effects, text, animations, music formats, and interactive panoramic images.

An integer overflow vulnerability exists in versions earlier than Apple QuickTime 7.7.1 when processing specially crafted video files. Attackers can exploit this vulnerability to execute arbitrary code with the current user permission.

<* Source: Luigi Auriemma (aluigi@pivx.com)

Link: http://support.apple.com/kb/HT5016
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apple
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://support.apple.com/