Quicktime Security Update for 7.1.6 (Yes, really!)
/** Hope you Windows guys have better luck with this update than other Apple Updates in the past **/
UPDATE: Alot of people have written in telling us that 7.1.6 is the current version and there are no other updates. Yes, 7.1.6 IS CURRENT. This is a security update FOR 7.1.6 as indicated in the subject. Please see: http://www.apple.com/support/downloads/ you will see that there ARE Security Updates.
http://docs.info.apple.com/article.html?artnum=305531
Security Update (QuickTime 7.1.6)
QuickTime
CVE-ID: CVE-2007-2388
Available for: QuickTime 7.1.6 for Mac OS X and Windows
Impact: Visiting a malicious website may lead to arbitrary code execution
Description: An implementation issue exists in QuickTime for Java, which may allow instantiation or manipulation of objects outside the bounds of the allocated heap. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of Java applets. Credit to John McDonald, Paul Griswold, and Tom Cross of IBM Internet Security Systems X-Force, and Dyon Balding of Secunia Research for reporting this issue.
QuickTime
CVE-ID: CVE-2007-2389
Available for: QuickTime 7.1.6 for Mac OS X and Windows
Impact: Visiting a malicious website may lead to the disclosure of sensitive information
Description: A design issue exists in QuickTime for Java, which may allow a web browser's memory to be read by a Java applet. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to the disclosure of sensitive information. This update addresses the issue by clearing memory before allowing it to be used by untrusted Java applets.
(Information came from Apple's website)
--
Joel Esler
http://handlers.sans.org/jesler
UPDATE: Alot of people have written in telling us that 7.1.6 is the current version and there are no other updates. Yes, 7.1.6 IS CURRENT. This is a security update FOR 7.1.6 as indicated in the subject. Please see: http://www.apple.com/support/downloads/ you will see that there ARE Security Updates.
http://docs.info.apple.com/article.html?artnum=305531
Security Update (QuickTime 7.1.6)
QuickTime
CVE-ID: CVE-2007-2388
Available for: QuickTime 7.1.6 for Mac OS X and Windows
Impact: Visiting a malicious website may lead to arbitrary code execution
Description: An implementation issue exists in QuickTime for Java, which may allow instantiation or manipulation of objects outside the bounds of the allocated heap. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of Java applets. Credit to John McDonald, Paul Griswold, and Tom Cross of IBM Internet Security Systems X-Force, and Dyon Balding of Secunia Research for reporting this issue.
QuickTime
CVE-ID: CVE-2007-2389
Available for: QuickTime 7.1.6 for Mac OS X and Windows
Impact: Visiting a malicious website may lead to the disclosure of sensitive information
Description: A design issue exists in QuickTime for Java, which may allow a web browser's memory to be read by a Java applet. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to the disclosure of sensitive information. This update addresses the issue by clearing memory before allowing it to be used by untrusted Java applets.
(Information came from Apple's website)
--
Joel Esler
http://handlers.sans.org/jesler
Keywords:
0 comment(s)
×
Diary Archives
Comments