Brief Hands-On Report--Apple released QuickTime 7.3 and iTunes 7.5

Apple released QuickTime 7.3 and iTunes 7.5. QuickTime 7.3 for Mac OS X 10.3.9, 10.4.9 and later and 10.5 is available via Software Update or as a stand-alone file from these Apple Web pages--Panther, Tiger and Leopard editions. According to Apple,

QuickTime 7.3 addresses critical security issues and delivers:

- Support for iTunes 7.5
- Updated support for creating iPhone-compatible web content
- Updated JavaScript support in the QuickTime Web Plug-in
- Numerous bug fixes

This release is recommended for all QuickTime 7 users.

Here are the details of QuickTime 7.3 security fixes:

CVE-ID: CVE-2007-2395--Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of QuickTime image descriptions. Credit to Dylan Ashe of Adobe Systems Incorporated for reporting this issue.

CVE-ID: CVE-2007-3750--Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of STSD atoms. Credit to Tobias Klein of www.trapkit.de for reporting this issue.

CVE-ID: CVE-2007-3751--Untrusted Java applets may obtain elevated privileges. This update addresses the issues by making QuickTime for
Java no longer accessible to untrusted Java applets. Credit to Adam
Gowdiak for reporting this issue.

CVE-ID: CVE-2007-4672--Opening a maliciously crafted PICT image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of PICT files. Credit to Ruben Santamarta of reversemode.com working with TippingPoint and the Zero Day Initiative for reporting this issue.

CVE-ID: CVE-2007-4675--Viewing a maliciously crafted QTVR movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing bounds checking on panorama sample atoms. Credit to Mario Ballano from 48bits.com working with the VeriSign iDefense VCP for reporting this issue.

CVE-ID: CVE-2007-4676--Opening a maliciously crafted PICT image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of PICT files. Credit to Ruben Santamarta of reversemode.com working with TippingPoint and the Zero Day Initiative for reporting this issue.

CVE-ID: CVE-2007-4677--Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of color table atoms. Credit to Ruben Santamarta of reversemode.com and Mario Ballano of 48bits.com working with TippingPoint and the Zero Day Initiative for reporting this issue.

iTunes 7.5 for Mac OS X 10.3.9, 10.4.7 or later and 10.5 is available via Software Update or as a stand-alone file from this Apple Web page. According to Apple,

iTunes 7.5 features the ability to activate iPhone wherever service is offered and support for Phase, a new interactive music game designed exclusively for iPod nano (third generation), iPod classic, and iPod (fifth generation). This release also includes bug fixes to improve stability and performance.

We downloaded and installed both updates on a Mac mini Core Duo, 15" MacBook Pro Core 2 Duo, 24" aluminum iMac Core 2 Duo, PowerMac G4 Cube, 12" PowerBook G4 (all running Leopard) and a 24" white iMac Core 2 Duo running Tiger 10.4.10. The only installation problem encountered was on our MacBook Pro--it would not shut down after installing both updates. The gear logo kept spinning on a blue screen for over 30 minutes. We forced a shutdown with the power button and the restart took a long time with a black screen but the MacBook Pro eventually started up.

All computers run fine with brief use of QuickTime and iTunes. iTunes 7.5 seems to have fixed our problem of needed to select Quit twice in order to get QuickTime 7,4,2 to quit on our MacBook Pro. The only use issue is that our Cube will no longer sleep with an Imation Disk Stakka attached but that was probably an anomaly because sleep has been an issue with the USB 2.0 Disk Stakka. [Bill Fox & Dana Baggett]