RETIRED: Apple QuickTime Prior To 7.7.4 Multiple Arbitrary Code Execution Vulnerabilities
BID:60086
Info
RETIRED: Apple QuickTime Prior To 7.7.4 Multiple Arbitrary Code Execution Vulnerabilities
| Bugtraq ID: | 60086 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 22 2013 12:00AM |
| Updated: | May 23 2013 09:53AM |
| Credit: | [email protected], Tom Gallagher (Microsoft), Paul Bates (Microsoft), Mil3s beep, G. Geshev, and Andrea Micalizzi aka rgod working with HP's Zero Day Initiative, roob working with iDefense VCP. |
| Vulnerable: |
Apple QuickTime Player 7.7.2 Apple QuickTime Player 7.7.1 Apple QuickTime Player 7.6.8 Apple QuickTime Player 7.6.7 Apple QuickTime Player 7.6.6 Apple QuickTime Player 7.6.5 Apple QuickTime Player 7.6.4 Apple QuickTime Player 7.6.2 Apple QuickTime Player 7.6.1 Apple QuickTime Player 7.5.5 Apple QuickTime Player 7.3.1 .70 Apple QuickTime Player 7.3.1 Apple QuickTime Player 7.1.6 Apple QuickTime Player 7.1.5 Apple QuickTime Player 7.1.4 Apple QuickTime Player 7.1.3 Apple QuickTime Player 7.1.2 Apple QuickTime Player 7.1.1 Apple QuickTime Player 7.0.4 Apple QuickTime Player 7.0.3 Apple QuickTime Player 7.0.2 Apple QuickTime Player 7.0.1 Apple QuickTime Player 7.0 Apple QuickTime Player 7.7 Apple QuickTime Player 7.6.9 Apple QuickTime Player 7.6 Apple QuickTime Player 7.3 Apple QuickTime Player 7.2 Apple QuickTime Player 7.1 |
| Not Vulnerable: | |
Discussion
RETIRED: Apple QuickTime Prior To 7.7.4 Multiple Arbitrary Code Execution Vulnerabilities
Apple QuickTime is prone to multiple vulnerabilities that may allow remote attackers to execute arbitrary code.
These issues arise when the application handles specially crafted files. Successful exploits may allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts will cause denial-of-service conditions.
Versions prior to QuickTime 7.7.4 are vulnerable on Windows 7, Vista, and XP.
This BID is being retired. The following individual records exist to better document the issues:
60109 Apple QuickTime CVE-2013-0987 Memory Corruption Vulnerability
60110 Apple QuickTime CVE-2013-1015 Memory Corruption Vulnerability
60108 Apple QuickTime CVE-2013-1020 Memory Corruption Vulnerability
60092 Apple QuickTime CVE-2013-1016 Buffer Overflow Vulnerability
60104 Apple QuickTime CVE-2013-1022 Buffer Overflow Vulnerability
60103 Apple QuickTime CVE-2013-1021 Buffer Overflow Vulnerability
60102 Apple QuickTime CVE-2013-1019 Buffer Overflow Vulnerability
60101 Apple QuickTime CVE-2013-0989 Buffer Overflow Vulnerability
60100 Apple QuickTime CVE-2013-0988 Buffer Overflow Vulnerability
60099 Apple QuickTime CVE-2013-0986 Buffer Overflow Vulnerability
60098 Apple QuickTime CVE-2013-1018 Buffer Overflow Vulnerability
60097 Apple QuickTime CVE-2013-1017 Buffer Overflow Vulnerability
Apple QuickTime is prone to multiple vulnerabilities that may allow remote attackers to execute arbitrary code.
These issues arise when the application handles specially crafted files. Successful exploits may allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts will cause denial-of-service conditions.
Versions prior to QuickTime 7.7.4 are vulnerable on Windows 7, Vista, and XP.
This BID is being retired. The following individual records exist to better document the issues:
60109 Apple QuickTime CVE-2013-0987 Memory Corruption Vulnerability
60110 Apple QuickTime CVE-2013-1015 Memory Corruption Vulnerability
60108 Apple QuickTime CVE-2013-1020 Memory Corruption Vulnerability
60092 Apple QuickTime CVE-2013-1016 Buffer Overflow Vulnerability
60104 Apple QuickTime CVE-2013-1022 Buffer Overflow Vulnerability
60103 Apple QuickTime CVE-2013-1021 Buffer Overflow Vulnerability
60102 Apple QuickTime CVE-2013-1019 Buffer Overflow Vulnerability
60101 Apple QuickTime CVE-2013-0989 Buffer Overflow Vulnerability
60100 Apple QuickTime CVE-2013-0988 Buffer Overflow Vulnerability
60099 Apple QuickTime CVE-2013-0986 Buffer Overflow Vulnerability
60098 Apple QuickTime CVE-2013-1018 Buffer Overflow Vulnerability
60097 Apple QuickTime CVE-2013-1017 Buffer Overflow Vulnerability
Exploit / POC
Apple QuickTime Prior To 7.7.4 Multiple Arbitrary Code Execution Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RETIRED: Apple QuickTime Prior To 7.7.4 Multiple Arbitrary Code Execution Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Apple QuickTime Prior To 7.7.4 Multiple Arbitrary Code Execution Vulnerabilities
References:
References:
- Apple QuickTime Homepage (Apple)