Integer overflow in Apple QuickTime Player 7.0.3 and 7.0.4 and iTunes 6.0.1 and 6.0.2 allows remote attackers to execute arbitrary code via a FlashPix (FPX) image that contains a field that specifies a large number of blocks.

The remote Windows host is running a version of QuickTime prior to 7.1. 

The remote version of QuickTime is vulnerable to various integer and buffer overflows involving specially crafted image and media files. An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having him open it using QuickTime player.

The remote Mac OS X host is running a version of Quicktime prior to 7.1. 

The remote version of Quicktime is vulnerable to various integer and buffer overflows involving specially crafted image and media files. An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having him open it using QuickTime player.

The remote Mac OS X host is running a version of Quicktime prior to 7.1.  The remote version of Quicktime is vulnerable to various integer and buffer overflows involving specially-crafted image and media files.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having it opened using QuickTime player.

ID	Name	Product	Family	Severity
21556	QuickTime < 7.1 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
21554	Quicktime < 7.1 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
3616	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
801197	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2006-1249

critical

Tenable Plugins

high

high

high

high