Apple has fixed a flaw in its QuickTime media playback software that allowed malicious coders to install malware onto vulnerable systems.

The vulnerability - which affects both Windows and Mac OS X PCs - was published as part of the "Month of Apple Bugs" project, which involves a plan to release details of previously undisclosed Mac OS X or Apple application security bugs every day in January.

The flaw attracted particular attention because of the availability of exploit code targeting it, which greatly increased the risk it posed.

Apple has released fixes for QuickTime 7.1.3 on Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.8, Mac OS X Server v10.4.8, Windows XP/2000as (explained here), which users are advised to apply in order to guard against exploitation. ®

Related stories

• RealPlayer users warned over unpatched vuln (3 January 2008)
• Security maven: QuickTime flaw threatens PCs, Macs (12 September 2007)
• Serious security hole plugged in RealPlayer and HelixPlayer (28 June 2007)
• Apple patches more than a dozen holes in OS X (25 May 2007)
• Apple patches security hole in QuickTime (2 May 2007)
• Updated QuickTime, not Safari, to blame for MacBook vuln (25 April 2007)
• Safari zero-day exploit nets $10,000 prize (20 April 2007)
• Exploit for latest Windows vuln already animated (30 March 2007)
• MySpace-hosted malware exploits QuickTime flaw (16 March 2007)
• Apple megapatch fixes multiple flaws (14 March 2007)
• Apple QuickTime update lances multiple bugs (6 March 2007)
• Bug brokers offering higher bounties (25 January 2007)
• Month of Apple Bugs scheme yields first fixes (5 January 2007)
• Unpatched bug bites QuickTime (3 January 2007)
• Apple updates to defend against OS, app and QuickTime flaws (15 May 2006)