Apple today released QuickTime 7.5 for Mac and Windows which improves application compatibility and addresses security issues, including:
• CVE-ID: CVE-2008-1581
Available for: Windows Vista, XP SP2
Impact: Opening a maliciously crafted PICT image file may lead to an unexpected application termination or arbitrary code execution
Description: An issue in QuickTime’s handling of PixData structures when processing a PICT image may result in a heap buffer overflow. Opening a maliciously crafted PICT image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. This issue does not affect systems running Mac OS X. Credit to Dyon Balding of Secunia Research for reporting this issue.
QuickTime
• CVE-ID: CVE-2008-1582
Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2
Impact: Opening a maliciously crafted AAC-encoded media content may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in QuickTime’s handling of AAC-encoded media content. Opening a maliciously crafted media file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of media files. Credit to Dave Soldera of NGS Software, and Jens Alfke for reporting this issue.
• CVE-ID: CVE-2008-1583
Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2
Impact: Opening a maliciously crafted PICT image file may lead to an unexpected application termination or arbitrary code execution
Description: A heap buffer overflow exists in QuickTime’s handling of PICT images. Opening a maliciously crafted PICT image file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Liam O Murchu of Symantec for reporting this issue.
• CVE-ID: CVE-2008-1584
Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2
Impact: Viewing maliciously crafted Indeo video media content may lead to an unexpected application termination or arbitrary code execution
Description: An issue in QuickTime’s handling of Indeo video codec content may result in a stack buffer overflow. Viewing a maliciously crafted movie file with Indeo video codec content may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by not rendering Indeo video codec content. Credit to an anonymous researcher working with TippingPoint’s Zero Day Initiative for reporting this issue.
• CVE-ID: CVE-2008-1585
Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 – v10.4.11, Mac OS X v10.5 or later, Windows Vista, XP SP2
Impact: Playing maliciously crafted QuickTime content in QuickTime Player may lead to arbitrary code execution
Description: A URL handling issue exists in QuickTime’s handling of file: URLs. This may allow arbitrary applications and files to be launched when a user plays maliciously crafted QuickTime content in QuickTime Player. This update addresses the issue by revealing files in Finder or Windows Explorer rather than launching them. Credit to Vinoo Thomas and Rahul Mohandas of McAfee Avert Labs, and Petko D. (pdp) Petkov of GNUCITIZEN working with TippingPoint’s Zero Day Initiative for reporting this issue.
More info and download links:
• QuickTime 7.5 for Leopard – 56MB
• QuickTime 7.5 for Tiger – 52.8MB
• QuickTime 7.5 for Panther – 51.39MB
– QuickTime 7.5 for Windows – 22.67MB
[Thanks to MacDailyNews Reader “Jim – TIV” for the heads up.]
I want my QuickTime X!
“QuickTime 7.5 for Windows – 22.67MB”
It’s like feeding truffles to a pig.
This is apparently only for Intel Macs. It didn’t show up in my iMac G5 Software Update window.
All of the links above are taking you to the Windows updater
@Dave Marsh
It should up on my PowerPC computers
@Ampar:
Thats one of the funniest things I’ve heard in a while.
Thanks.
Check for updates from the QuickTime Player’s preferences… it will show up there. It doesn’t show up in Software Update.
@Ampar
Pigs seem to value truffles. Alas, Windows users seem to walk right by them!
MDN wake up! The links for the updaters are wrong!
MacGeez:
” width=”19″ height=”19″ alt=”grin” style=”border:0;” /> And wings2sky, you speak with great truthiness.
QT 7.5 Playback VERY CHOPPY
I have this same problem.
http://discussions.apple.com/thread.jspa?threadID=1554014&tstart=0
it’s choppy on my powerbook g4! it was fine before this update. how do i go back??? how am i going to watch “apple mobileme guide tour?”
@Dave Marsh, et al.
It shows up in Software Update on my PowerBook G4.
Lesson to the new Mac users
Wait until the “early adopters” who clone their boot drives using Carbon Copy Cloner or SuperDuper and can easily “revert” to a early install and can give the “all clear” before doing a Software Update.
Apple does indeed make mistakes and the newbies might not have the ability to revert as easily.
Cloned boot drives are “hold option bootable” so it makes it easy to “reverse clone” for your info.
Time Machine drives are not bootable, which is a shame.
Anybody using Flip-for-Mac that has upgraded? Issues? I’m holding out on upgrading till the end of a video project.
I like MDN like this. It loads faster.
They’ll fix it next week…just like Visat. hic!
DO NOT LOAD 7.5 IF YOU USE AVI FILES. YOU WILL LOSE AUDIO. OTHERS HAVE HAD PROBLEMS WITH ITUNES AND VLC AFTER “UPGRADING” TO 7.5
IF YOU HAVE, GET THE SHAREWARE PROGRAM CALLED PACIFIST. IT WILL ALLOW YOU TO REPLACE 7.5 WITH 7.4.5 AND GET YOUR AUDIO BACK.