Details of QuickTime 6.5.2 Security Fix

2004–09October 27, 2004Macs Only!Security
As we noted below, QuickTime 6.5.2 was released yesterday by Apple. It should now be available via the Software Update preference pane as well as via the QuickTime web page. QuickTime 6.5.2 delivers two security enhancements, one for Windows only and one for Mac OS X and Windows--here is the Mac fix:

CVE-ID: CAN-2004-0926

Available for: Mac OS X v10.3.x, Mac OS X Server v10.3.x, Mac OS X
v10.2.8, Mac OS X Server v10.2.8, Microsoft Windows XP, Microsoft
Windows 2000, Microsoft Windows ME and Microsoft Windows 98
Impact: A heap buffer overflow could allow attackers to execute
arbitrary code

Description: Flaws in decoding the BMP image type could overwrite
heap memory and potentially allow the execution of arbitrary code
hidden in an image. This is the same security enhancement that was
made available in Security Update 2004-09-30, and can be deployed on
the additional system configurations covered by this QuickTime
update.


Saw something? Send a tip

The archive ran on reader tips. What did you see, where, and do you want the credit?

Read by the editor. Never published without your say.

More in Security · This month in the archive