Heap-based buffer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with M-JPEG encoding, which causes QuickTime to calculate a buffer size using height and width fields, but to use a different field to control the length of a copy operation.

The version of QuickTime installed on the remote Windows host is older than 7.6.6.  Such versions contain several vulnerabilities :

  - A heap-based buffer overflow in QuickTime's handling of     PICT images may lead to an application crash or     arbitrary code execution. (CVE-2009-2837)

  - A memory corruption issue in QuickTime's handling of     QDM2 encoded audio content may lead to an application     crash or arbitrary code execution. (CVE-2010-0059)

  - A memory corruption issue in QuickTime's handling of     QDMC encoded audio content may lead to an application     crash or arbitrary code execution. (CVE-2010-0060)

  - A heap-based buffer overflow in QuickTime's handling of     H.263 encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0062)

  - A heap-based buffer overflow in QuickTime's handling of     H.261 encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0514)

  - A memory corruption issue in QuickTime's handling of     H.264 encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0515)

  - A heap-based buffer overflow in QuickTime's handling of     RLE encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0516)

  - A heap-based buffer overflow in QuickTime's handling of     M-JPEG encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0517)

  - A memory corruption issue in QuickTime's handling of     Sorenson encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0518)

  - An integer overflow in QuickTime's handling of FlashPix     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-0519)

  - A heap-based buffer overflow in QuickTime's handling of     FLC encoded movie files may lead to an application crash     or arbitrary code execution. (CVE-2010-0520)

  - A heap-based buffer overflow in QuickTime's handling of     MPEG encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0526)

  - An integer overflow in QuickTime's handling of PICT     images may lead to an application crash or arbitrary     code execution. (CVE-2010-0527)

  - A memory corruption issue in QuickTime's handling of     color tables in movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0528)

  - A heap-based buffer overflow in QuickTime's handling of     PICT images may lead to an application crash or     arbitrary code execution. (CVE-2010-0529)

  - A memory corruption issue in QuickTime's handling of     BMP images may lead to an application crash or arbitrary     code execution. (CVE-2010-0536)

The version of QuickTime installed on the remote Mac OS X host is older than 7.6.6.  Such versions contain several vulnerabilities :

  - A memory corruption issue in QuickTime's handling of     QDM2 encoded audio content may lead to an application     crash or arbitrary code execution. (CVE-2010-0059)

  - A memory corruption issue in QuickTime's handling of     QDMC encoded audio content may lead to an application     crash or arbitrary code execution. (CVE-2010-0060)

  - A heap buffer overflow in QuickTime's handling of H.263     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-0062)

  - A heap buffer overflow in QuickTime's handling of H.261     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-0514)

  - A memory corruption issue in QuickTime's handling of     H.264 encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0515)

  - A heap buffer overflow in QuickTime's handling of RLE     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-0516)

  - A heap buffer overflow in QuickTime's handling of M-JPEG     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-0517)

  - A memory corruption issue in QuickTime's handling of     Sorenson encoded movie files may lead to an application     crash or arbitrary code execution. (CVE-2010-0518)

  - An integer overflow in QuickTime's handling of FlashPix     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-0519)

  - A heap buffer overflow in QuickTime's handling of FLC     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-0520)

  - A heap buffer overflow in QuickTime's handling of MPEG     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-0526)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

The version of QuickTime installed on the remote host is older than 7.6.6.  Such versions contain several vulnerabilities : 

  - A heap buffer overflow in QuickTime's handling of PICT images may lead to an application crash or arbitrary code execution. (CVE-2009-2837)

  - A memory corruption issue in QuickTime's handling of QDM2 encoded audio content may lead to an application crash or arbitrary code execution. (CVE-2010-0059)

  - A memory corruption issue in QuickTime's handling of QDMC encoded audio content may lead to an application crash or arbitrary code execution. (CVE-2010-060)

  - A heap buffer overflow in QuickTime's handling of H.263 encoded movie file may lead to an application crash or arbitrary code execution. (CVE-2010-0062)

  - A heap buffer overflow in QuickTime's handling of H.261 encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0514)

  - A memory corruption issue in QuickTime's handling of H.264 encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0515)

  - A heap buffer overflow in QuickTime's handling of RLE encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0516)

  - A heap buffer overflow in QuickTime's handling of M-JPEG encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0517)

  - A memory corruption issue in QuickTime's handling of Sorensen encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0518)

  - An integer overflow in QuickTime's handling of FlashPix encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0519)

  - A heap buffer overflow in QuickTime's handling of FLC encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0520)

  - A heap buffer overflow in QuickTime's handling of MPEG encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0526)

  - An integer overflow in QuickTime's handling of PICT images may lead to an application crash or arbitrary code execution. (CVE-2010-0527)

  - A memory corruption issue in QuickTime's handling of color tables in movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0528)

  - A heap buffer overflow in QuickTime's handling of PICT images may lead to an application crash or arbitrary code execution. (CVE-2010-0529)

  - A memory corruption issue in QuickTime's handling of BMP images may lead to an application crash or arbitrary code execution. (CVE-2010-0536)

ID	Name	Product	Family	Severity
45388	QuickTime < 7.6.6 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
45387	QuickTime < 7.6.6 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
801207	QuickTime < 7.6.6 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5492	QuickTime < 7.6.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical

Detections

Analytics

CVE-2010-0517

high

Tenable Plugins

high

high

critical

critical

high

critical