Apple has patched a critical flaw in its QuickTime media player software for the Mac and Windows operating systems. Apple QuickTime 7.1.6 fixes a buffer overflow vulnerability in QuickTime for Java.
Apple says the flaw "may allow reading or writing out of the bounds of the allocated heap. By enticing a user to visit a web page containing a maliciously-crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional bounds checking when creating QTPointerRef objects."
The company generously credits Dino Dai Zovi , TippingPoint and the Zero Day Initiative for reporting the flaw which was discovered eight days ago. The flaw was uncovered at a Hack A Mac event at the CanSecWest security conference in Vancouver, Canada.
Airport Extreme for Intel
Apple has also issued an AirPort Extreme Update 2007-003 for Intel-equipped Macs. The update "includes compatibility updates for certain third-party access points configured to use WPA or WPA2 security."
Apple has also released v1.1 of its Security Update 2007-004 which was issued earlier this month. it only affects some Mac models but addresses the following issues:
- AirPort Available for: Mac OS X v10.3.9. This update corrects an issue where the AirPort connection may be lost after waking from sleep. This issue only affects Mac OS X v10.3.9 with Security Update 2007-004.
- FTPServer Available for: Mac OS X Server v10.4.9. Security Update 2007-004 applied an incorrect ftp configuration file for Mac OS X Server v10.4.9 systems. Users with ftp access, who would normally be restricted to certain directories, may be able to access directories outside the normal scope.
- All three patches are available from Software Update which can be accessed via the Apple menu. You can also download them from
