Feeds

Apple plugs two QuickTime holes

Second security patch in less than a week

Secure remote control for conventional and virtual desktops

Apple has plugged two holes in its QuickTime media player that could create serious security problems for people tricked into visiting malicious websites. The release, which is available for both Windows and Mac platforms, is Apple's second security patch in less than a week.

The most serious of the two vulnerabilities involves QuickTime's implementation of Java, which could allow for the manipulation of objects outside what should be allowed by the allocated heap.

"By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution," Apple said in this advisory.

Apple gave credit to John McDonald, Paul Griswold, and Tom Cross of IBM Internet Security Systems X-Force and Dyon Balding of Secunia Research for reporting the flaw.

The other vulnerability also resides in the way QuickTime works with Java and could allow a maliciously crafted applet to read a web browser's memory. That could allow an attacker access to potentially sensitive information, Apple said.

If it seems like Apple security team has been working overtime, it's because it has. On Thursday, the maker of the increasingly popular iMac and iBook released its fifth mega patch in as many months. This fixed more than a dozen security vulnerabilities in OS X. Less than three weeks earlier, Apple patched another hole in QuickTime that could also allow a booby-trapped website to execute malicious code on unwitting Mac users.

QuickTime has emerged as one of the more vulnerable Apple packages, with at least four security updates this year. QuickTime's susceptibility is due in part to its ability to run on both Windows and OS X and its wide use (and occasional abuse) on sites such MySpace.

Apple's update is here. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Nexus 7 fandroids tell of salty taste after sucking on Google's Lollipop
Web giant looking into why version 5.0 of Android is crippling older slabs
All aboard the Poo Bus! Ding ding, route Number Two departing
Only another three days of pooing and I can have a ride!
Official: European members prefer to fondle Apple iPads
Only 7 of 50 parliamentarians plump for Samsung Galaxy S
Fujitsu CTO: We'll be 3D-printing tech execs in 15 years
Fleshy techie disses network neutrality, helmet-less motorcyclists
Space Commanders rebel as Elite:Dangerous kills offline mode
Frontier cops an epic kicking in its own forums ahead of December revival
Dragon Age Inquisition: Our chief weapons are...
Bioware's fantasy forces in fine fettle
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.