
One of the researchers behind the project, a former hacker known as LMH, said he was stunned by the length of time it took Apple to fix the bug.
Taking 23 days for a remote issue that leads to code execution right away is insane, he said in a statement. There was already an exploit and it was being abused in targeted attacks.
The QuickTime vulnerability affects the way the media player runs the Real Time Streaming Protocol (RTSP).
A hacker could exploit the bug and compromise the user's computer by inserting a RTSP string in a QuickTime file, causing the user to open the file, according to an advisory on Apple's website.
The patch is available to download from the company's website or using the Mac OS X software update.