Known as a 'boundary condition error', the flaw exists in the player's handling of header information for multimedia files. An attacker could place specially-crafted XML code within an audio or movie file and cause the application to crash.
Discovery of the flaw was credited to a researcher using the handle 'securfrog'. There have been no reports of the vulnerability being targeted in the wild.
It is not yet known whether the crash would also allow for the remote execution of code on the target machine. The vulnerability exists in both the MacOS and Windows versions of the QuickTime 7.5.5 player and iTunes 8.0.
Security firm Intego is currently classifying the vulnerability as a low-risk flaw, though the danger from attack could increase significantly should remote code execution be found possible.
News of the vulnerability comes just days after Apple released major updates for both QuickTime and iTunes. In addition to new features, the updates contained numerous security patches.
.png&h=140&w=231&c=1&s=0)
.png&w=100&c=1&s=0)
_page-0001.jpg&w=100&c=1&s=0)
.png&w=120&c=1&s=0)
Tech in Gov 2025
Forrester's Technology & Innovation Summit APAC 2025
Local Government Focus Day Western Australia
Digital Leadership Day Western Australia
Government Cyber Security Showcase Western Australia
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
