Brief Hands-On Report--QuickTime 7.0.4 & Security Details

The QuickTime update is available via the Software Update application and as a stand-alone file from this Apple Web page. According to the Read Me file,

QuickTime 7.0.4 is an important release that delivers numerous bug fixes, support for iLife '06, and H.264 performance improvements. This update is highly recommended for all QuickTime 7 users.

Here are the details on security updates in QuickTime 7.0.4:

CVE-ID: CVE-2005-2340
Impact: A maliciously-crafted QTIF image may result in arbitrary code execution
Description: By carefully crafting a corrupt QTIF image, an attacker can trigger a heap buffer overflow that may result in arbitrary code execution. This update addresses the issue by performing additional validation of GIF images. Credit to Varun Uppal of Kanbay for reporting this issue.

CVE-ID: CVE-2005-3707, CVE-2005-3708, CVE-2005-3709
Impact: Viewing a maliciously-crafted TGA image may result in arbitrary code execution
Description: By carefully crafting a corrupt TGA image, an attacker can trigger a buffer overflow, integer overflow, or integer underflow that may result in a denial-of-service or arbitrary code execution. This update addresses the issue by performing additional validation of TGA images. Credit to Dejun Meng of Fortinet for reporting this issue.

CVE-ID: CVE-2005-3710, CVE-2005-3711
Impact: Viewing a maliciously-crafted TIFF image may result in arbitrary code execution
Description: By carefully crafting a corrupt TIFF image, an attacker can trigger an integer overflow that may result in a denial-of-service or arbitrary code execution. This update addresses the issue by performing additional validation of TIFF images. Credit to Dejun Meng of Fortinet for reporting this issue.

CVE-ID: CVE-2005-3713
Impact: A maliciously-crafted GIF image may result in arbitrary code execution
Description: By carefully crafting a corrupt GIF image, an attacker can trigger a heap buffer overflow that may result in arbitrary code execution. This update addresses the issue by performing additional validation of GIF images. Credit to Karl Lynn of eEye Digital Security for reporting this issue.

CVE-ID: CVE-2005-4092
Impact: A maliciously-crafted media file may result in arbitrary code execution
Description: By carefully crafting a corrupt media file, an attacker can trigger a heap buffer overflow that may result in arbitrary code execution. This update addresses the issue by performing additional validation of media files. Credit to Karl Lynn of eEye Digital
Security for reporting this issue.

We downloaded and installed the update with no problem on our 12" PowerBook G4 and rev.A iMac G5. [Bill Fox & Dana Baggett]