Vulnerability Note VU#921193
Apple QuickTime fails to properly handle corrupt media files
Apple QuickTime contains a heap overflow vulnerability in the handling of media files which may allow a remote unauthenticated attacker to execute arbitrary code or cause a denial of service on a vulnerable system.
Apple's QuickTime Player is multimedia software that allows users to view local and remote audio, video, and image content. Quicktime contains a heap overflow vulnerability in code that handles the stsd atom of a media file.
This vulnerability may be triggered by using the QuickTime Player or an application that uses the QuickTime plug-in, such as a web browser.
A remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial of service if the user is persuaded to view a specially crafted media file.
Install an update
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Apple Computer, Inc.||Affected||-||11 Jan 2006|
CVSS Metrics (Learn More)
This vulnerability was reported by Apple Product Security, who in turn credit Karl Lynn of eEye Digital Security.
This document was written by Will Dormann.
- CVE IDs: CVE-2005-4092
- Date Public: 10 Jan 2006
- Date First Published: 11 Jan 2006
- Date Last Updated: 12 Jan 2006
- Severity Metric: 43.88
- Document Revision: 13
If you have feedback, comments, or additional information about this vulnerability, please send us email.