Integer overflow in Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT file.

The version of QuickTime installed on the remote Windows host is older than 7.7.1 and may be affected by the following vulnerabilities :

  - A cross-site scripting issue exists in HTML files     generated by the 'Save for Web' export feature.
    (CVE-2011-3218)

  - A buffer overflow error exists in the handling of     H.264 encoded video files. (CVE-2011-3219)

  - An error exists in the processing of URL data handlers     in movie files and can allow access to uninitialized     areas of memory. (CVE-2011-3220)

  - An error exists in the handling of the 'atoms'     hierarchy as well as 'TKHD atoms' in movie files.
    (CVE-2011-3221, CVE-2011-3251)

  - Buffer overflow errors exist in the processing of     of FlashPix, FLIC, PICT and FLC-encoded files.     (CVE-2011-3222, CVE-2011-3223, CVE-2011-3247,     CVE-2011-3249)

  - An unspecified error can allow memory corruption when     viewing certain video files. (CVE-2011-3228)

  - An error related to signedness exists in the handling     of font tables in QuickTime video files. (CVE-2011-3248)

  - An integer overflow error exists in the handling of     JPEG2000 encoded video files. (CVE-2011-3250)

Versions of QuickTime earlier than 7.7.1 are potentially affected by multiple vulnerabilities :

  - A buffer overflow exists in the handling of H.264 encoded movie files. (CVE-2011-3219)

  - An uninitialized memory access issue exists in the handling of URL data handlers within movie file. (CVE-2011-3220)

  - An implementation issue exists in the handling of the atom hierarchy within a movie files. (CVE-2011-3221)

  - A cross-site scripting issue exists int he Save for Web export. (CVE-2011-3218)

  - A buffer overflow exists in the handling of FlashPix files. (CVE-2011-3222)

  - A buffer overflow exists in the handling of FLIC files. (CVE-2011-3223)

  - Multiple memory corruption issues exist in the handling of movie files. (CVE-2011-3228)

  - An integer overflow issue exists in the handling of PICT files. (CVE-2011-3247)

  - A signedness issue exists in the handling of font tables embedded n QuickTime movie files.

  - A buffer overflow issue exists in the handling of FLC encoded movie files. (CVE-2011-3249)

  - An integer overflow issue exists in the handling of JPEG2000 encoded movie files. (CVE-2011-3250)

  - A memory corruption issue exists in the handling of TKHD atoms in QuickTime movie files. (CVE-2011-3251)

ID	Name	Product	Family	Severity
56667	QuickTime < 7.7.1 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
801196	QuickTime < 7.7.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6052	QuickTime < 7.7.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2011-3247

high

Tenable Plugins

high

high

high