—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

APPLE-SA-2014-10-22-1 QuickTime 7.7.6

QuickTime 7.7.6 is now available and addresses the following:

QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Playing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
RLE encoded movie files. This issue was addressed through improved
bounds checking.
CVE-ID
CVE-2014-1391 : Fernando Munoz working with iDefense VCP, Tom
Gallagher & Paul Bates working with HP’s Zero Day Initiative

QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Playing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
the ‘mvhd’ atoms. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2014-4979 : Andrea Micalizzi aka rgod working with HP’s Zero Day
Initiative

QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Playing a maliciously crafted MIDI file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of MIDI
files. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2014-4350 : s3tm3m working with HP’s Zero Day Initiative

QuickTime
Available for: Windows 7, Vista, XP SP2 or later
Impact: Playing a maliciously crafted m4a file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of audio
samples. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2014-4351 : Karl Smith of NCC Group

QuickTime 7.7.6 may be obtained from the QuickTime Downloads site:
http://www.apple.com/quicktime/download/

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple’s Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

—–BEGIN PGP SIGNATURE—–
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools – http://gpgtools.org

iQIcBAEBAgAGBQJUSBRSAAoJEBcWfLTuOo7tgDoQAIBUrnAQpbBQoanvqNDw5R2j
Ntl+aKzuZaVloKn78HN0T5ihcx3K0FxtjCN//KGwJpKBCG8MGnF/CisEnstkLM3t
jn6oZ0kmowAOt0CEM6s391uWTNnV+Na3dN7WBNu7943+qkTbUiSeojTEE9DHpxCN
tE/hmyBR3dEpAKza8rQzGYYZTBJ9wFhcL91M9hmo0ZXrfgdRE8xFQBnEHtUPqv1N
QBgVm6GVKxFhgNcUZnk/+JNWpPxlWGDyb+N7mB7H8FIPUJRbxMsJaAro9JjyjM2h
Za5gNgVTdNNeM0iVItbt8a6JLo+F1CFD6dJJvFZUSoGYhCevfIrRHNmZBKynLFNw
lciM0iUXgoEwTsgfwOQf9gr8QSzMdTrODXgX6PQptKL2xSxHQ15Vumz9Z+LdZb2B
osh/+iGndw+xQCojR3+IomTZlxlHEaGxm45PkRtYwrAsmXXNnsOIC5Eqrk5sFpPH
gDioMLytASE2Y+ASBTHT0kNOVs2BY/2uLlToE+/tf908oLOjDpmHmbzk9PZHrJsX
hGaqFdrpGmZsm1QcO05/ykoPiqka1C9cgJHYKdXddeTCZEss4oFB0ER/fQ7cz6Bc
iOV80BMWMFArsZMPmiwltCYfiw82HxeTgc7UvRHGFlXmpE4q1lHrU1dt+NkOnmv9
t/srMKTMnrGAAGLz0jqq
=PiXJ
—–END PGP SIGNATURE—–

—–BEGIN PGP SIGNATURE—–
Comment: GPGTools – http://gpgtools.org

iQIcBAEBAgAGBQJUSBVBAAoJEBcWfLTuOo7tA7EP/RWYn699kjOrm25rUe6t7/LN
vqPO8SMFcQWx5Gu1LonVzNGjo9U3afqr3BfDya4TYjCXhjVoSDihYHEfzZ3PNogv
hVr1eui/YSJY774BjqMsPTK09LoMQbpyS7rWQXPBdnhFkjLEWArsoT6jgzk4IVdf
SvNpfvxxnKSE8uiEP45amuVySu9vPcJxOkfpqIwo2Zj4GSBWuP8jcx7nLQ8m6cqL
Mfit1HdvGuBjJxwgG9iPLLu5z5E4oBkAngAAwj1ItSDMho0ZkbiloNjY7+ioTG7z
9rg8k8o+8q7w7dizO9DpQI9AiqVqCiL6ceUykBrpiJYsSAuGjQ8nwsyxB3WeRO6l
GyZ4ffiK9MCWkG4RiqvEZhtmjTskH1YH0wYUJsB7ORg9BFd8cT0czCroDkmF4G39
Dy6BtvDmuJa+rpDmksZoX5EY58gaeBpK6XXTMRvqvZkkA6EYfiJyz/7gv+7lEQBm
FvWi6UrAzzolQ2kILFMAhUXSXKDqfD8X2fzCinNt5516XEbX5EJ7h/AwUP1q84aH
t3yZsBskRlLFNwOVYtkcCB2BID42DhPewqOgwu0zGLNAGFLk4pfM1R4QiGaf1I/e
6pu0wviSR16vandbKuyFYsklf1sZ3C56LluoaS3lysdbNl45mIxPAJ2Xg3RHEXun
XM1sP+p8evHnqvb5PisL
=JK+X
—–END PGP SIGNATURE—–
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (Security-announce@lists.apple.com)