|
|
|
|
| |
Credit:
The information has been provided by Damian Put.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-10-252/
|
| |
Vulnerable Systems:
* Apple Quicktime
The specific flaw exists within the application's support for a component within the SIZ marker in a JPEG 2000 image. When the component contains a malicious value, the application will add a corrupted object to a queue of data which will be processed by the Component Manager's JP2 decompressor. Later when attempting to decompress this data, the application will use the corrupted object. This can lead to code execution under the context of the application.
Patch Availability:
Please refer to the following Apple documents:
Mac OS X 10.6.5: http://support.apple.com/kb/HT4435
QuickTime 7.6.9: http://support.apple.com/kb/HT4447
CVE Information:
CVE-2010-3788
Disclosure Timeline:
2010-06-01 - Vulnerability reported to vendor
2010-11-10 - Coordinated public release of advisory
|
|
|
|
|
