Apple Releases Patch For 15 QuickTime Vulnerabilities

For those of you out there who are running QuickTime on your Macs or PCs, a new version has been released which fixes 15 different security vulnerabilities. Of the bugs fixed, 14 were touted with the ability to "lead to an unexpected application termination or arbitrary code execution" according to Apple. The final flaw which only affects those running the movie player on Windows, could potentially allow access to a portion of the user's profile.

In a security advisory released by Apple this past Tuesday, the 15 patched vulnerabilities are described. There are multiple file types which can be used to cause different flavors of memory overflows in the QuickTime software. These file types are JP2, avi, movie, FlashPix, Gif, PICT, and QTVR. When one of these files is "maliciously crafted," it can be used to overflow various heap buffers and initiate uninitialized memory access. Apple has implemented better bounds checking and improved file handling when those files are found to be corrupted. Only QuickTime 7.x was affected by this security bulletin. That means that users running Snow Leopard and QuickTime X will not be affected. Earlier versions of OSX and all Windows (XP, Vista, and 7) are affected.

This is yet another example of how no operating system is completely virus-proof. While there is no evidence of any of these vulnerabilities being exploited in the wild, they certainly could have been. Seeing how Apple's market share has grown exponentially in the last few years, with Mac taking over college campuses around the country, it is certainly time to stop calling Mac a 'virus-proof' alternative to Windows. The only reason there are not more viruses for Apple products is because there are so many more Windows users to target. As the Mac user base increases, so will the interest in Mac viruses.