Another QuickTime RTSP flaw announced
143389
This QuickTime buffer overflow vulnerability appears to be different from a similar vulnerability patched by Apple in December 2007.
581853
Proof of concept exploit sparks full disclosure row Security watchers warn that an unpatched vulnerability in RealPlayer poses a severe risk.â¦
758734
(InfoWorld) - Mozilla has fixed a critical bug in the way the Firefox browser works with QuickTime media files. The flaw, which was reported last week by hacker Petko Petkov, gives attackers a way to run unauthorized commands on a victim's PC. "This could be used to install malware, steal local data, or otherwise corrupt the victim's computer," Mozilla said in a security advisory published Tuesday. A July 2007 patch was supposed to take care of this type of problem, but Petkov showed how attackers could still run commands on a victim's system by tricking a victim into opening a maliciously coded QuickTime media file. In fact, until Apple addresses the underlying flaw in QuickTime, there still could be headaches for users, Mozilla said in its security advisory on the issue. "QuickTime Media-link files could still be used to annoy users with popup windows and dialogs until this issue is fixed in QuickTime," the advisory states. The common security measure of disabling JavaScript does not prevent this attack, although the NoScript Firefox add-on does provide protection, Mozilla said. "Petkov provided proof of concept code that may be easily converted into an exploit, so users should consider this a very serious issue," Mozilla's security chief, Window Snyder said in a recent blog posting. Mozilla has been able to reproduce this bug only on the Windows operating system, she added. The flaw also affects the Internet Explorer browser, Petkov said on his blog. However, IE's security policies make the flaw less critical on Microsoft's browser, he added. The Firefox 2.0.0.7 update was pushed out to users starting around 3 p.m. Pacific Time on Tuesday. It contains only one security update: the QuickTime fix.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
532930
Microsoft has issued a critical security bulletin regarding a buffer overrun vulnerability that exists when Windows processes JPEG image files. The flaw could allow code to be remotely executed and give an attacker full control over an affected system. Microsoft has posted a September 2004 Security Update to correct the issue.
663829
The FrSIRT site has posted a new advisory for users of the Vivvo Article Management CMS software about potential holes that could allow for some very large-scale damage to be done.    Multiple vulnerabilities have been identified in Vivvo Article Management CMS, which could be exploited by remote attackers to compromise a vulnerable server.   The first issue is due to an input validation error in the "pdf_version.php" script that does not validate the "id" parameter before being used in SQL statements, which could be exploited by malicious people to conduct SQL injection attacks.   The second vulnerability is due to an input validation error in the "index.php" script that do not validate the "classified_path" parameter, which may be exploited by remote attackers to include local or remote scripts with the privileges of the web server.    Versions 3.2 and higher of the software are effected, and, unfortunately, there has been no patch issued for the issue.
52161
A bug in version 11 of RealPlayer was found by a Russian security firm over the holiday and has been confirmed by US-CERT.
324860
Microsoft has released yet another hotfix&#39;to fix a newly discovered problem in its XP Service Pack2 (XP SP2) release.
245392
InfoWorld - US-CERT is warning computer users of a possible problem with the latest version of RealPlayer after a Russian security company claimed to have found a way to exploit a critical flaw in the multimedia software.
36424
Complaints roll in claiming a problem in which QuickTime 7.4 disables Adobe After Effects.
663104
Apple has released a new security patch for QuickTime, its eighth update this year for the media player software.The update addresses three critical security holes in QuickTime, including a vulnerability that has been used in attacks by online criminals.The most critical of the flaws lies in QuickTime&#39;s implementation of the Real Time Streaming Protocol (RTSP), used to play audio and video over the Internet. The flaw was made public Nov. 23, and in early December&#160;attackers began exploiting the flaw in online attacks. By tricking victims into visiting a malicious Web site that exploited the flaw, hackers were able to install malicious software on the victims&#39; PCs.To date, these attacks have targeted Windows-based systems, but security experts say that Mac OS X users are also at risk to the vulnerability. Apple issued patches for both Windows and Mac OS X users on Thursday.The second critical vulnerability, which had apparently not been publicly disclosed , has to do with a flaw in the QuickTime Media Link (QTL) file format used by the media player. Security researchers have recently been looking at the way QuickTime works with these files as a potential source of new bugs.Apple also patched a handful of similar bugs in the way that QuickTime handles Adobe&#39;s Flash media format. The most serious of these flaws could let attackers run unauthorized software on the computer, much as the RTSP bug does, Apple said.With security researchers paying special attention to media format bugs, Apple has had to patch QuickTime frequently this year. Some of these updates have come just weeks apart. Apple last patched QuickTime on Nov. 5.&#160;
300950
Update addresses potential denial-of-service vulnerabilities as well as a flaw in QuickTime.
143929
Microsoft Windows users need to watch out for several flaws in non-Microsoft media players.
413975
(InfoWorld) - One week afterÂ updating its Mac OS X operating system, Apple has patched a serious flaw it its QuickTime media player. The security update to QuickTime 7.1.6, published Tuesday, fixes two issues in the way QuickTime works on the Java platform. The most serious of these problems could give criminals a way of taking control of an unpatched computer, Apple said in a security alert. "By enticing a user to visit a Web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution," the alert states. The second bug is considered to be less critical, but it could allow an attacker to have a look into the Web browser's memory and lead to the disclosure of sensitive information, Apple said. This latest QuickTime update is available for both Mac OS and Windows users. Apple's security team has been busy of late. Last week's Mac OS X patches fixed 17 flaws, several of which were considered to be critical. Apple also fixed a similar QuickTime for Java bug on May 1 after this flaw was used to claim a $10,000 Mac hacking prize at the April's CanSecWest security conference.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
23136
The hacker who discovered a recently patched QuickTime flaw affecting the Firefox browser says he has found an equally serious flaw in Adobe Systems Inc.&#39;s PDF file format.
531228
Nevis Networks, a market leader in persistent LAN security solutions,  today announced that Nevis Labs has identified a vulnerability in Apple  QuickTime.
498941
(InfoWorld) - Users are being advised to upgrade to newer versions of the RealPlayer and Helix Player multimedia products because of a critical security flaw. The flaw could allow an attacker to gain control over a user's PC using a buffer overflow vulnerability, a memory problem that can allow unauthorized code to run on a machine, according to iDefense Inc. The vulnerability was discovered last October but publicly disclosed Tuesday on iDefense's Web site. Affected versions of the software include the 10.5 "gold" RealPlayer and any 1.x version of Helix Player, according to the French Security Incident Response Team (FrSIRT). FrSIRT categorized the problems as "critical," adding that a denial-of-service attack is also possible. RealPlayer users should receive notification of a "critical update," advising them to upgrade toÂ the beta version of a new release, version 11, said Lewis Webb, a spokesman for RealNetworks. The new version can be downloaded from the RealPlayer Web site, although the site does not mention the security problem. Current versions of Helix Player, an open-source version of RealPlayer, are available on itsÂ developer Web site. For a successful attack, a user would have to be tricked into downloading from a Web site a malicious SMIL (synchronized multimedia integration language) file, a format used in rendering media, iDefense said. Â