Known as a 'boundary condition error', the flaw exists in the player's handling of header information for multimedia files. An attacker could place specially-crafted XML code within an audio or movie file and cause the application to crash.
Discovery of the flaw was credited to a researcher using the handle 'securfrog'. There have been no reports of the vulnerability being targeted in the wild.
It is not yet known whether the crash would also allow for the remote execution of code on the target machine. The vulnerability exists in both the MacOS and Windows versions of the QuickTime 7.5.5 player and iTunes 8.0.
Security firm Intego is currently classifying the vulnerability as a low-risk flaw, though the danger from attack could increase significantly should remote code execution be found possible.
News of the vulnerability comes just days after Apple released major updates for both QuickTime and iTunes. In addition to new features, the updates contained numerous security patches.
.png&h=140&w=231&c=1&s=0)
.png&w=100&c=1&s=0)
Digital As Usual Cybersecurity Roadshow: Brisbane edition
iTnews Benchmark Security Awards 2025
Digital Leadership Day Federal
Government Cyber Security Showcase Federal
Government Innovation Showcase Federal
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
