QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3667, and CVE-2015-3668.

Versions of QuickTime older than 7.7.7 are affected by the following vulnerabilities :

  - A flaw is triggered as user-supplied input is not properly validated when handling specially crafted image data in an SGI file allowing a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-3661) 
 - An out-of-bounds write flaw is triggered as user-supplied input is not properly validated when handling specially crafted image data in a GIF file allowing a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-3662, CVE-2015-3663) 
 - An overflow condition is triggered as user-supplied input is not properly validated when handling alis atoms. With a specially crafted file, a context-dependent attacker can cause a stack-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2015-3664) 
 - A use-after-free error is triggered when handling object properties in a specially crafted movie file allowing a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-3665) 
 - A flaw is triggered as user-supplied input is not properly validated when handling the code atom within the Media Information (minf) atom allowing a context-dependent attacker to use a specially crafted file to corrupt memory and potentially execute arbitrary code. (CVE-2015-3666) 
 - A use-after-free error in the 'QuickTimeMPEG4!0x147f0()' function is triggered when an out-of-bounds read error occurs during the handling of stbl ataoms. With a specially crafted movie (.MOV) file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (CVE-2015-3667) 
 - A flaw is triggered as user-supplied input is not properly validated when handling a specially crafted track fragment's 'size' field inside a moof atom allowing a context-dependent attacker to cause a heap-based buffer overflow and potentially execute arbitrary code. (CVE-2015-3668) 
 - An overflow condition is triggered as user-supplied input is not properly validated. With a specially crafted SGI file, a context-dependent attacker can cause a heap-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2015-3669)

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.4 and the following components contain vulnerabilities :

  - Admin Framework 
-  afpserver 
 - apache 
 - AppleFSCompression 
 - AppleGraphicsControl 
 - AppleThunderboltEDMService 
 - ATS 
 - Bluetooth 
 - Certificate Trust Policy 
 - CFNetwork HTTPAuthentication 
 - CoreText 
 - coreTLS 
 - DiskImages 
 - Display Drivers 
 - EFI 
 - FontParser 
 - Graphics Driver 
 - ImageIO 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAcceleratorFamily 
 - IOFireWireFamily 
 - Kernel 
 - kext tools 
 - Mail 
 - ntfs 
 - ntp 
 - OpenSSL 
 - QuickTime 
 - Security 
 - Spotlight 
 - SQLite 
 - System Stats 
 - TrueTypeScaler 
 - zip

The version of Apple QuickTime installed on the remote Windows host is prior to 7.7.7. It is, therefore, affected by multiple vulnerabilities :

  - An arbitrary code execution vulnerability exists due to     improper validation of user-supplied input. An attacker     can exploit this, with specially crafted image data in     an SGI file, to execute arbitrary code. (CVE-2015-3661)

  - An arbitrary code execution vulnerability exists due to     an out-of-bounds write flaw caused by improper     validation of user-supplied input. An attacker can     exploit this, with specially crafted image data in     a GIF file, to execute arbitrary code. (CVE-2015-3662)

  - An arbitrary code execution vulnerability exists due to     an out-of-bounds write flaw caused by improper     validation of user-supplied input. An attacker can     exploit this, with a specially crafted image descriptor     in a GIF file, to execute arbitrary code.
    (CVE-2015-3663)

  - An overflow condition exists due to improper validation     of user-supplied input when handling 'alis' atoms. An     attacker can exploit this, with a specially crafted     file, to cause a stack-based buffer overflow, resulting     in a denial of service condition or the execution of     arbitrary code. (CVE-2015-3664)

  - A user-after-free error exists when handling object     properties in movie files. An attacker can exploit this,     with a specially crafted movie file, to dereference     already freed memory, potentially resulting in the     execution of arbitrary code. (CVE-2015-3665)

  - A memory corruption flaw exists due to improper     validation of user-supplied input when handling the     'code' atom within the 'minf' (Media Information) atom.
    An attacker can exploit this, with a specially crafted     file, to corrupt memory, potentially resulting in the     execution of arbitrary code. (CVE-2015-3666)

  - A user-after-free error exists in the     QuickTimeMPEG4!0x147f0() function when handling 'stbl'     atoms. An attacker can exploit this, with a specially     crafted .MOV file, to dereference already freed memory,     potentially resulting in the execution of arbitrary     code. (CVE-2015-3667)

  - A memory corruption flaw exists due to improper     validation of user-supplied input when handling movie     files. An attacker can exploit this, with a specially     crafted file, to corrupt memory, potentially resulting     in the execution of arbitrary code. (CVE-2015-3668)

  - An overflow condition exists due to improper validation     of user-supplied input. An attacker can exploit this,     with a specially crafted SGI file, to cause a heap-based     buffer overflow, potentially resulting in the execution     of arbitrary code. (CVE-2015-3669)

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-005. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - afpserver
  - apache
  - AppleFSCompression
  - AppleGraphicsControl
  - AppleThunderboltEDMService
  - ATS
  - Bluetooth
  - Certificate Trust Policy
  - CFNetwork HTTPAuthentication
  - CoreText
  - coreTLS
  - DiskImages
  - Display Drivers
  - EFI
  - FontParser
  - Graphics Driver
  - ImageIO
  - Install Framework Legacy
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOFireWireFamily
  - Kernel
  - kext tools
  - Mail
  - ntfs
  - ntp
  - OpenSSL
  - QuickTime
  - Security
  - Spotlight
  - SQLite
  - System Stats
  - TrueTypeScaler
  - zip

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.4. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - afpserver
  - apache
  - AppleFSCompression
  - AppleGraphicsControl
  - AppleThunderboltEDMService
  - ATS
  - Bluetooth
  - Certificate Trust Policy
  - CFNetwork HTTPAuthentication
  - CoreText
  - coreTLS
  - DiskImages
  - Display Drivers
  - EFI
  - FontParser
  - Graphics Driver
  - ImageIO
  - Install Framework Legacy
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOFireWireFamily
  - Kernel
  - kext tools
  - Mail
  - ntfs
  - ntp
  - OpenSSL
  - QuickTime
  - Security
  - Spotlight
  - SQLite
  - System Stats
  - TrueTypeScaler
  - zip

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
9304	Apple QuickTime < 7.7.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
8801	Mac OS X < 10.10.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
84505	Apple QuickTime < 7.7.7 Multiple Vulnerabilities (Windows)	Nessus	Windows	medium
84489	Mac OS X Multiple Vulnerabilities (Security Update 2015-005) (GHOST) (Logjam)	Nessus	MacOS X Local Security Checks	critical
84488	Mac OS X 10.10.x < 10.10.4 Multiple Vulnerabilities (GHOST) (Logjam)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2015-3666

high

Tenable Plugins

critical

critical

medium

critical

critical