Apple releases QuickTime 7.3.1

Apple today released QuickTime 7.3.1 for Mac and Windows. This update addresses security issues including the following:

• CVE-ID: CVE-2007-6166

Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista / XP SP2

Impact: Viewing a maliciously crafted RTSP movie may lead to an unexpected application termination or arbitrary code execution

Description: A buffer overflow exists in QuickTime’s handling of Real Time Streaming Protocol (RTSP) headers. By enticing a user to view a maliciously crafted RTSP movie, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by ensuring that the destination buffer is sized to contain the data.

• CVE-ID: CVE-2007-4706

Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista / XP SP2

Impact: Viewing a maliciously crafted QTL file may lead to an unexpected application termination or arbitrary code execution

Description: A heap buffer overflow exists in QuickTime’s handling of QTL files. By enticing a user to view a maliciously crafted QTL file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking.

• CVE-ID: CVE-2007-4707

Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista / XP SP2

Impact: Multiple vulnerabilities in QuickTime’s Flash media handler

Description: Multiple vulnerabilities exist in QuickTime’s Flash media handler, the most serious of which may lead to arbitrary code execution. With this update, the Flash media handler in QuickTime is disabled except for a limited number of existing QuickTime movies that are known to be safe. Credit to Tom Ferris of Adobe Secure Software Engineering Team (ASSET), Mike Price of McAfee Avert Labs, and security researchers Lionel d’Hauenens & Brian Mariani of Syseclabs for reporting this issue.

The update is available via Software Update and also as standalone installers.

More info and download links:

QuickTime 7.3.1 for Leopard – 52.6 MB
QuickTime 7.3.1 for Tiger- 48.7 MB
• QuickTime 7.3.1 for Panther – 50.9 MB

• QuickTime 7.3.1 for Windows – 20.3 MB

31 Comments

  1. Apple-free on my Dell PC and loving it! It’s stuff like this that reminds me precisely why I run Windows. Everything on my Dell runs so much better without the scourge of insecure Apple crapware on it. No QuickTime or iTunes to destroy an otherwise magnificent and supremely secure computing experience with Vista. Suck it, MAC sheep.

    Your potential. Our passion.™

  2. Flash Media Handler disabled…well that sure screws a lot of people that bought into this QuickTime Interactive BS. What do they mean by “except for a limited number of existing QuickTime movies”?

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.