Detections
Analytics

QuickTime < 7.6.6 Multiple Vulnerabilities (Mac OS X)

high Nessus Plugin ID 45387

Language:

Synopsis

The remote Mac OS X host contains an application that is affected by multiple vulnerabilities.

Description

The version of QuickTime installed on the remote Mac OS X host is older than 7.6.6. Such versions contain several vulnerabilities :

 - A memory corruption issue in QuickTime's handling of QDM2 encoded audio content may lead to an application crash or arbitrary code execution. (CVE-2010-0059)

 - A memory corruption issue in QuickTime's handling of QDMC encoded audio content may lead to an application crash or arbitrary code execution. (CVE-2010-0060)

 - A heap buffer overflow in QuickTime's handling of H.263 encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0062)

 - A heap buffer overflow in QuickTime's handling of H.261 encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0514)

 - A memory corruption issue in QuickTime's handling of H.264 encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0515)

 - A heap buffer overflow in QuickTime's handling of RLE encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0516)

 - A heap buffer overflow in QuickTime's handling of M-JPEG encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0517)

 - A memory corruption issue in QuickTime's handling of Sorenson encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0518)

 - An integer overflow in QuickTime's handling of FlashPix encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0519)

 - A heap buffer overflow in QuickTime's handling of FLC encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0520)

 - A heap buffer overflow in QuickTime's handling of MPEG encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-0526)

Solution

Upgrade to QuickTime 7.6.6 or later.

See Also

http://support.apple.com/kb/HT4104

http://lists.apple.com/archives/security-announce/2010/Mar/msg00002.html

http://www.securityfocus.com/advisories/19386

Plugin Details

Severity: High

ID: 45387

File Name: macosx_Quicktime766.nasl

Version: 1.12

Type: local

Agent: macosx

Published: 3/31/2010

Updated: 7/14/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:apple:quicktime

Required KB Items: MacOSX/QuickTime/Version, Host/uname

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/30/2010

Vulnerability Publication Date: 3/30/2010

Reference Information

CVE: CVE-2010-0059, CVE-2010-0060, CVE-2010-0062, CVE-2010-0514, CVE-2010-0515, CVE-2010-0516, CVE-2010-0517, CVE-2010-0518, CVE-2010-0519, CVE-2010-0520, CVE-2010-0526

BID: 39152, 39154, 39155, 39159, 39161, 39163, 39164, 39165, 39166, 39167