Apple releases QuickTime update to patch seven vulnerabilities

By

Apple on Monday released a new version of its popular QuickTime media player to resolve seven vulnerabilities, six of which could have been exploited to remotely install malicious code on a user's machine.

Apple releases QuickTime update to patch seven vulnerabilities
The bugs, rated "highly critical" by tracking firm Secunia, are corrected in QuickTime 7.3 for Mac and Windows operating systems, according to an Apple security advisory.

The six most dangerous vulnerabilities are related to a memory corruption, a stack buffer overflow and four heap buffer overflows. The seventh vulnerability resides in Java and may permit untrusted applets to obtain privilege escalation.

"It looks like seven pretty nasty vulnerabilities that either due privilege escalation or code execution," Eric Schultze, chief technology officer of Shavlik Technologies, told SCMagazineUS.com today. "I would not go viewing a movie until I got this patched."

This is the fourth new version of QuickTime to be released this year, according to Apple.

"Apple is no better at security than Microsoft," Schultze said. "Everybody has equal numbers of flaws in their code."

Schultze said he recommends Windows and Mac users patch as soon as possible.

"You may not even know QuickTime exists on your box," he said. "They say there's an auto update in QuickTime, but it doesn't always update correctly. You're best off going to Apple's website and updating to the latest version."

An Apple spokesperson did not return a call for comment.

See original article on SC Magazine US
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Log In

  |  Forgot your password?