QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file that causes an image sample transformation to scale a sprite outside a buffer boundary.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components :

  - App Store
  - ATS
  - Certificate Trust Policy
  - CoreFoundation
  - CoreGraphics
  - FTP Server
  - ImageIO
  - International Components for Unicode
  - Kernel
  - Libsystem
  - libxslt
  - MobileMe
  - MySQL
  - OpenSSL
  - patch
  - QuickLook
  - QuickTime
  - Samba
  - servermgrd
  - subversion

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion

Versions of QuickTime earlier than 7.6.9 are potentially affected by multiple vulnerabilities :

  - A filesystem permission issue may allow a local user on a Windows system to access the contents of the 'Apple Computer' directory in the user's profile. (CVE-2010-0530)

  - A heap buffer overflow in QuickTime's handling of Track Header (tkhd) atoms may lead to an application crash or arbitrary code execution on Windows systems. (CVE-2010-1508)

  - A heap buffer overflow in Quicktime's handling of JP2 images may lead to an application crash or arbitrary code execution. (CVE-2010-3787)

  - Uninitialized memory access issue in QuickTime's handling of JP2, FlashPix, and GIF images may lead to an application crash or arbitrary code execution. (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of AVI files, movie files, Sorenson encoded movie files, PICT files, FlashPix images, and panorama atoms in QTVR (QuickTime Virtual Reality) movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793, CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-encoded movie files may lead to an application crash or arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie files may lead to an application crash or arbitrary code execution. (CVE-2010-4009)

The version of QuickTime installed on the remote Windows host is older than 7.6.9.  Such versions contain several vulnerabilities :

  - A filesystem permission issue may allow a local user     on a Windows system to access the contents of the     'Apple Computer' directory in the user's profile.
    (CVE-2010-0530)

  - A heap-based buffer overflow in QuickTime's handling of     Track Header (tkhd) atoms may lead to an application     crash or arbitrary code execution on Windows systems.
    (CVE-2010-1508)

  - A heap-based buffer overflow in QuickTime's handling of     JP2 images may lead to an application crash or arbitrary     code execution. (CVE-2010-3787)

  - Uninitialized memory access issues in QuickTime's     handling of JP2, FlashPix, and GIF images may lead to     an application crash or arbitrary code execution.
    (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of     AVI files, movie files, Sorenson encoded movie files,     PICT files, FlashPix images, and panorama atoms in QTVR     (QuickTime Virtual Reality) movie files may lead to an     application crash or arbitrary code execution.
    (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793,     CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie     files may lead to an application crash or arbitrary     code execution. (CVE-2010-4009)

The version of QuickTime installed on the remote Mac OS X host is older than 7.6.9.  Such versions contain several vulnerabilities :

  - A heap buffer overflow in QuickTime's handling of JP2     images may lead to an application crash or arbitrary     code execution. (CVE-2010-3787)

  - Uninitialized memory access issues in QuickTime's     handling of JP2, FlashPix, and GIF images may lead to     an application crash or arbitrary code execution.     (CVE-2010-3788, CVE-2010-3794, CVE-2010-3795)

  - Memory corruption issues in QuickTime's handling of     AVI files, movie files, Sorenson encoded movie files,     PICT files, FlashPix images, and panorama atoms in QTVR     (QuickTime Virtual Reality) movie files may lead to an     application crash or arbitrary code execution.     (CVE-2010-3789, CVE-2010-3790, CVE-2010-3793,     CVE-2010-3800, CVE-2010-3801, CVE-2010-3802)

  - A buffer overflow in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3791)

  - A signedness issue in QuickTime's handling of MPEG-     encoded movie files may lead to an application crash or     arbitrary code execution. (CVE-2010-3792)

  - An integer overflow in QuickTime's handling of movie     files may lead to an application crash or arbitrary     code execution. (CVE-2010-4009)

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.5.

Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - Apache
  - AppKit
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - Image Capture
  - ImageIO
  - Image RAW
  - Kernel
  - MySQL
  - neon
  - Networking
  - OpenLDAP
  - OpenSSL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - QuickTime
  - Safari RSS
  - Time Machine
  - Wiki Server
  - X11
  - xar

ID	Name	Product	Family	Type	Severity
55416	Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	critical
5968	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic		critical
5725	QuickTime < 7.6.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
51062	QuickTime < 7.6.9 Multiple Vulnerabilities (Windows)	Nessus	Windows	Local	high
51061	QuickTime < 7.6.9 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	Local	high
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic		critical
50548	Mac OS X 10.6.x < 10.6.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	critical

Detections

Analytics

CVE-2010-3790

high

Tenable Plugins

critical

critical

medium

high

high

critical

critical