Apple pushes a QuickTime 7.6 security update

By Tim Conneally | Published January 22, 2009, 1:36 PM

Addressing security issues for both the Mac and Windows platforms, Apple has released an update to QuickTime not unlike the one released last spring, only less prolific.

Seven QuickTime vulnerabilities are addressed in the latest update, all revolving around malware movie files that cause "unexpected application termination or arbitrary code execution."

Among these are heap buffer overflow issues in QuickTime's handling of THKD atoms in QTVR (QuickTime Virtual Reality) movie files, in the handling of RTSP (Real Time Streaming Protocol) URLs, and in handling JPEG atoms in QuickTime movie files. The other issues include a memory corruption issue in H.263 encoded movies, a signedness issue in Cinepak-encoded files, and a buffer overflow involved with the handling of MPEG-2 videos with MP3 audio.

The update is available at support.apple.com/downloads for Windows Vista and XP SP2 and SP3, or through "Software Update" in the OS X (v10.4.9 - v10.5) command menu.

Comments

View comments by with a score of at least

Garabage is not PC but Quicktime!

Score: 0

|

This must be where all the cry babies come together. Nobody forces you guys to use QuickTime on your garbage PCs. Whatever problems you have are your fault for using a virus prone Mac rip operating system. Live with it, except it.

Life Is Good On A Mac.™

Score: -1

|

"The update is available...through "Software Update" in the OS X"

Must be one of those virus prone Mac rip operating systems...

Score: 0

|

It crashes without security vulnerabilities every time when I run movie inspector (WinXP SP3). After so many versions it still contains serious bugs. It's more buggy then WMP. Go Apple!

Score: -1

|

Indeed go Apple! Because on my awesome Mac, QuickTime is flawless and a pleasure to use each day. Don't blame Apple for your crappy XP problems. Get a real OS and experience ZERO problems.

Life Is Good On A Mac.™

Score: 1

|

Really "ZERO?"

As in 0.

Less problems perhaps... but zero is an absolute that I would not proclaim.

Score: 0

|

"Get a real OS and experience ZERO problems."

No such thing exists.

Score: 0

|

It does if you're on a Mac. :)

Life Is Good On A Mac.™

Score: 0

|

Well, I know of at least SEVEN *recent* problems, in addition to the ELEVEN found before those... and that's just with ONE application on your "perfect" SIXTH version of OS X in less than EIGHT years. ;-)

ZERO, indeed...

Score: 0

|

Apple still isn't "pushing" this update. It is not available via "Apple Software update," and even if you download it on their site, you are pushed to pay for an install Quicktime Pro.

Very very shameful. Can you imagine if Microsoft made it so difficult* to do this?

* By difficult I mean the average user, not myself. :)

Score: 0

|

Why the **** isn't this being pushed out by apple update on any client I test it on? I have to manually download it.

Score: 0

|

Quicktime Lite for VCP has been updated, i would suggest grabbing that if you don't use iTunes etc

Score: 1

|

We block All quicktime update and installs. Does this "security update" add more the 4 apps to your machine?

Score: 2

|

Gee, sorta like the bundled MS updates.

Agreed, their bundling sucks.

Anyone who fails to scrutinize ANY updates and downloads for total content is a fool.

Score: -3

|

Honestly curious: What bundled MS updates?

Last time I installed a new version of their browser, IM, or Media Player, that's all I got...

Score: 2

|

Last time I updated windows media player. I DID NOT get Zune, IE 8 or anything else. M$ does not do this.

Score: 0

|

Like the Windows authentication tool that was requested by all interested owners of Windows...

oops..

Score: -2

|

Ha ha...

Funny.

You're comparing an authentication tool (arguably part of the OS) with completely unrelated applications and claiming they are equal?

How cute... and here I thought you were gaining some sense after your little bout with "The Dozens" BS.

Score: 0

|

So you still don't know what it means...
LOL!

I'm not comparing ANYTHING, dimwit! YOU ARE! I simply mentioned the practice. DUH!

And no IE huh? interesting. Oh, but MS defines that as part of the OS, unlike others, don't they?
And no, the authentication tool was not a part of the OS when we purchased or obtained it.
And you get plenty of components whether you use the tools or not...such as Outlook, IE, the authentication tools, Office and other components that may or may not be applicable to one's system.

Whether they are the same as the crap Apple dumps on you is a moot point. You are still potentially subjected to it by MS as well.

Score: -1

|

No, I "Googled" it. ...and somehow I still think it's utterly senseless.

Office isn't bundled with any other product by microsoft. OEMs bundle trials and the like, but OEMs have always loaded crap.

"Whether they are the same as the crap Apple dumps on you is a moot point."

No, that's *exactly* the point you were trying to make with your original comment.

"Gee, sorta like the bundled MS updates."

No. MS bundles no apps with their updates that I am aware of. WGA is a stretch and you know it.

Score: 0

|

Gee whiz Tool. ;-)
And yet you continue to trade insults in playful parody with the likes of Tweenboy and others. ...the dozens - an historically and culturally based tradition of 'fighting' through the trading of (hopefully) innovative and creative insults and jabs.

The problem is that I had he audacity to mention MS as well as Apple.

The fact is, that MS bundles an entire set of updates for one, supposedly based upon what one has installed.

To use an example, I don't have Outlook installed, and neither do I keep all of the components of Office installed. And on several computers IE isn't installed either.

But when I get the automatic updates that are ready for download, supperfluous components are routinely bundled for every MS component, regardless of whether they are installed or not.

And I don't need critical Outlook or IE or Access updates.

Thus, while the components may not be as innocuous as what Apple dumps on you, and which I indeed acknowledged in my first post (duh!), MS nonetheless dumps more than is necessary or appropriate on a user as well.

Especially as MS claims to authenicate and verify what you have and need before bunding them.

There is indeed a LARGE difference in degree between Apple's crap and what MS bundles, but it is only one of degree, as both benefit from scrutiny.

Sorry the notion is just too complicated for you.
But why not simply acknowledge the fact that the real problem is that someone had the unmitigated audacity to mention your sacred cow, MS.

Maybe you should spend more time gloating over their actively trying to litigate against open source, as they hire IBM to port UNIX code over to Windows, rather than innovating. (Especially as I consider the latter of the two as a very astute move with regards to employing IBM's expertise.)

Score: 0

|

*yawn*

You've strayed way beyond the point and made far more of it that it is.

You're comparing OS Updates to Applications, an absurdity in and of itself.....which totally misses the point. Apples and Oranges.

I'm out. Argue with yourself for a bit. :)

Score: -1

|

"But when I get the automatic updates that are ready for download, supperfluous components are routinely bundled for every MS component, regardless of whether they are installed or not."

Actually, this is in fact a very wise move.
It means that when and if you decide to install one of the components you didn't install to begin with they are automatically up to date and you don't have to install any other crap later.

It's hardly bundling as it's part of the same product (Office).

Score: 0

|

:-O

"It means that when and if you decide to install one of the components you didn't install to begin with they are automatically up to date and you don't have to install any other crap later."

Yup, just install the crap now and get it over with when there is absolutely no need nor desire for it.

Now we have proactive installation of crap.

And poor Tool, making too much of it? And I am comparing them?

Nope, I simply mentioned them as they both attempt to supply more than what is necessary. I never tried to compare any of what was presented for download! I just mentioned that it was done!

YOU ARE THE ONE TRYING TO COMPARE THEM! I simply mentioned the practice. DUH!

"You've strayed way beyond the point and made far more of it that it is."

LOL!

I simply mentioned MS's practice in addition to dittoing the Apple crap! YOU are the one that got your panties in a wad simply because we had the unmitigated audacity to mention your sacred cow Microsoft!!! And we never said they were literally equivalent!

But then MS is sacred and you simply can't deal with anyone saying ANYTHING about MS. Poor baby!

The fact is that neither are a really big deal to me, as I peruse what they want to dump on me and decide what I will accept.

I don't assume that either will put my interests before their own welfare!

And I don't become apoplectic over Either, unlike some here who only freak when Apple does somthing they don't like.

Score: 0

|

"Am I comparing them?"

"Gee, sorta like the bundled MS updates."

Huh... Figure it out for yourself, Oh Erudite Genius. Plain as day for the rest of us...

Score: 0

|

I will give him one thing... he is definitely quite adept at tap dancing and back-peddling. Quite the spin-meister.

All of this 'What I meant by that but you were too stupid to realize...' crap from him is getting rather tiresome. It's a twisted and demented game that only he seems to enjoy.

Score: 0

|

*shrug*

His original response cannot be mis-interpreted. It was a sarcastic slam on MS for bundling, only...updates != apps, and he apparently doesn't realize that.

..as for not becoming apoplectic or "making a big deal out of it"...look at the post lengths? The guy can't shut-up. Perhaps we could swallow the "I couldn't care less" bit a tad more easily if he didn't try so hard to be "right" about everything.

...

MS sacred cow.. *laughing* That's cute. Hate their hardware, hate their browser, firmly believe they totally botched Vista's launch...have stated all of this repeatedly...but apparently he "forgot" about those posts. How convenient... Some might think he "forgets" simply so he can troll out the "fanboy" BS over and over again...

Score: 0

|

"...look at the post lengths? The guy can't shut-up. Perhaps we could swallow the "I couldn't care less" bit a tad more easily if he didn't try so hard to be "right" about everything."

Indeed. His diatribes are usually longer than the articles themselves... and sometimes under articles dealing with subjects / devices which he claims to despise / not care about (gee, that sounds hypocr... I mean, familiar). But oh no, he'll find some way to flip it and justify why he's so vehemently berating those who he considers to be beneath him and hardly worthy of his precious time.

Considering some of his most recent multiple posts were each longer than Scott's two-page articles, that's absurd... especially considering that he barely touched on anything remotely related to the actual articles themselves.

If the recent silence is any indication, he seems to have moved on to "more substantial efforts" now. My guess: sitting in front of his television fondling himself while he watches re-runs of House M.D. whispering "Some day, Hugh... some day I'm gonna be just like you". He's probably working on his limp as we speak. LOL

One veteran pr*ck on this site is enough. Speaking of which... you were in an unusually pissy mood yesterday. Did a raid go tits-up in WoW? ;-)

Score: 0

|

Report: Microsoft to randomize Europe's browser screen choices

The fact that "A" is for "Apple" was apparently at the heart of browser vendor objections to Microsoft's alternative to listing IE first.

Acer eclipses Dell for #2 spot in global PC shipments, says iSuppli data

It literally does look like a 360-degree turnaround in Dell's fortunes, as the bells of bad tidings now toll solely for Dell.

Microsoft, don't hang up on Windows Mobile, but do call for help

Only a Manhattan Project can save Microsoft's phone strategy now.

See ya later, WinMo: Microsoft's mobile strategy needs a reboot

Carmi Levy | Wide Angle Zoom: Hands up if you're considering upgrading to a Windows phone for the holidays...Anybody?

Playing catch-up in 2010: Windows Mobile, BlackBerry, and Symbian

Microsoft, RIM, and Nokia are each working on improved mobile operating systems. But could these efforts add up to too little, too late?

Will Nokia's plans further alienate American consumers?

A look at Nokia's plans for the coming years does little to shine up the company's increasingly dull image.

Bing bonked by service outage Thursday, Microsoft configured the wrong server

It's always nice to have a backup, but it's even nicer to remember which one is the backup. That's the lesson Bing's admins learned yesterday evening.

Survey reveals there are more women then men, including on social networks

If you think you can market your products and services online as though you're selling car batteries in the middle of halftime, think again. And again.

Android team updates 'Donut' and 'Eclair' SDKs

The Android SDK includes components which optimize app development for each version of the mobile operating system. Today, the 1.6 and 2.0 components got updates.

The Black Screen Syndrome, or, Tech news in search of the apocalypse

Scott Fulton On Point: This is a story about something that should not have been a story, about something that at one time was a story.

Online advertising evolves away from display, toward interactive software

Marketing departments and agencies are increasingly establishing positions for "creative technologists" who can steer designers and developers toward platforms that enable direct connections with consumers.