Apple plugs QuickTime security hole

Apple Computer on Tuesday released QuickTime 7.0.1, an update to its media player software that promises several enhancements, but also fixes a security flaw, the Mac maker said in an advisory. A QuickTime movie containing a maliciously crafted Quartz Composer object could give an attacker access to local data and send it to an arbitrary Web location, the Apple posting said. The QuickTime update modifies the Quartz Composer plug-in to fix the issue, the company said.

The 25.7 MB update requires Max OS X 10.3.9 or later. It can be obtained and installed using Apple's Software Update feature or from Apple Downloads. The problem was reported to Apple by David Remahl, who has found several security problems in the past in Apple's products. Remahl rates the QuickTime issue "less critical."