The QuickTime vulnerability leaves users open to attack via a web page embedded with a specially-crafted streaming media file.
The malformed file targets a flaw in the multimedia tool's Remote Transfer Streaming Protocol (RTSP) component.
An attacker could cause QuickTime to crash and remotely execute code on the target system. The flaw was reported on 11 January by security researcher Luigi Auriemma.
This is not the first time Apple has had to patch a vulnerability in QuickTime's RTSP code. Another flaw led to a series of attacks in December.
Apple has also issued an update for iPhoto, the image organising and sharing application which is a standard component of the iLife suite for OS X.
The flaw could allow an attacker to create a malformed Photocast stream which would allow remote code execution on the system of all users who attempted to subscribe. Discovery of the vulnerability is credited to security researcher Nathan McFeters.
Both security updates can be downloaded through Apple's Software Update utility or from the Apple Downloads site.
Apple patches QuickTime and iPhoto flaws
By
Shaun Nichols
on Feb 11, 2008 3:25PM
Apple has issued updates for QuickTime and iPhoto affecting Mac OS X, Windows Vista and Windows XP users..
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
Promoted Content
Why there is no upside to sending data offshore for storage
Promoted Content
AWS She Builds seeks to bridge the great IT gender gap
Promoted Content
NDR meets ransomware threat head on
Promoted Content
Why CIOs must now think differently about application security
Sponsored Whitepapers
The 5 steps to effective data protection
Understanding the next security control points: applications and workloads
Best security practices after rapid Digital Transformation
The CISO View 2021 Survey: Zero Trust and Privileged Access
How and why to backup your Office 365 tenant
