QuickTime update includes 9 security patches

Apple's patches include both Windows and Mac OS X versions of the popular media player.

Robert Vamosi Former Editor

As CNET's former resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security.

See full bio

Robert Vamosi

Sept. 9, 2008 3:19 p.m. PT

3 min read

Apple on Tuesday released QuickTime 7.5.5, a version that includes nine security patches, some of which could lead to denial of service or allow an attacker to run code on a compromised machine. The patches cover both Windows and Mac OS X versions of QuickTime. Earlier Tuesday, Microsoft released two bulletins addressing serious vulnerabilities in its Windows Media Player.

QuickTime 7.5.5 may be obtained from the Apple Software Update application or you can download the latest version of free Quicktime player here.

QuickTime 1
This patch affects users of Windows Vista, XP SP2, and SP3. The update addresses CVE-2008-3615, a memory access vulnerability in the third-party (Indeo v5) codec for QuickTime. Apple says "viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution." This issue does not affect systems running Mac OS X.

QuickTime 2
This patch affects users of Windows Vista, XP SP2, and SP3. The update addresses CVE-2008-3635, stack buffer overflow vulnerability within in a third-party (Indeo v3.2) codec for QuickTime. Apple explains that viewing a maliciously crafted movie file "may lead to an unexpected application termination or arbitrary code execution." This issue does not affect systems running Mac OS X.

QuickTime 3
This patch affects users of Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2, and SP3. The update addresses the heap buffer overflow vulnerability detailed within CVE-2008-3624. Apple says that viewing a maliciously crafted QTVR (QuickTime Virtual Reality) movie file may lead to an "unexpected application termination or arbitrary code execution." Apple credits Roee Hay of IBM Rational Application Security Research Group for reporting the vulnerability.

QuickTime 4
This patch affects users of Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2, and SP3. The update addresses the stack buffer overflow vulnerability within CVE-2008-3625. Apple says viewing a maliciously crafted QTVR file may lead to an unexpected application termination or arbitrary code execution because of how QuickTime's handles panorama atoms in QTVR (QuickTime Virtual Reality) movie files.

QuickTime 5
This patch affects users of Windows Vista, XP SP2 and SP3. The update addresses the integer overflow vulnerability within CVE-2008-3614. Apple explains that users opening a maliciously crafted PICT image may suffer an unexpected application termination or arbitrary code execution. Apple credits an anonymous researcher working with the iDefense VCP for reporting the vulnerability. This issue does not affect systems running Mac OS X.

QuickTime 6
This patch affects users of Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2, and SP3. The update addresses the memory corruption issue vulnerability details within CVE-2008-3626. Apple says because of the way QuickTime handles STSZ atoms in movie files, viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. Apple credits an anonymous researcher working with TippingPoint's Zero Day Initiative for reporting the vulnerability.

QuickTime 7
This patch affects users of Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2, and SP3. The update addresses the memory corruption in QuickTime's handling of H.264 encoded movie files detailed within CVE-2008-3627. Apple says that viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. Apple credits an anonymous researcher and Subreption working with TippingPoint's Zero Day Initiative for reporting the vulnerability.

QuickTime 8
This patch affects users of Windows Vista, XP SP2, and SP3. The update addresses the invalid pointer issue detailed within CVE-2008-3628. Apple says opening a maliciously crafted PICT image may lead to an unexpected application termination or arbitrary code execution. Apple credits David Wharton for reporting the vulnerability. This issue does not affect systems running Mac OS X.

QuickTime 9
This patch affects users of Mac OS X v10.4.9 - v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2, and SP3. The update addresses the out-of-bounds read issue detailed within CVE-2008-3629. Apple says opening a maliciously crafted PICT image may lead to an unexpected application termination. Apple credits Sergio "shadown" Alvarez of n.runs AG for reporting the vulnerability.