The bugs, rated "highly critical" by tracking firm Secunia, are corrected in QuickTime 7.3 for Mac and Windows operating systems, according to an Apple security advisory.
The six most dangerous vulnerabilities are related to a memory corruption, a stack buffer overflow and four heap buffer overflows. The seventh vulnerability resides in Java and may permit untrusted applets to obtain privilege escalation.
"It looks like seven pretty nasty vulnerabilities that either due privilege escalation or code execution," Eric Schultze, chief technology officer of Shavlik Technologies, told SCMagazineUS.com today. "I would not go viewing a movie until I got this patched."
This is the fourth new version of QuickTime to be released this year, according to Apple.
"Apple is no better at security than Microsoft," Schultze said. "Everybody has equal numbers of flaws in their code."
Schultze said he recommends Windows and Mac users patch as soon as possible.
"You may not even know QuickTime exists on your box," he said. "They say there's an auto update in QuickTime, but it doesn't always update correctly. You're best off going to Apple's website and updating to the latest version."
An Apple spokesperson did not return a call for comment.
See original article on SC Magazine US
Apple releases QuickTime update to patch seven vulnerabilities
By
Dan Kaplan
on Nov 7, 2007 9:56AM
Apple on Monday released a new version of its popular QuickTime media player to resolve seven vulnerabilities, six of which could have been exploited to remotely install malicious code on a user's machine.
