More Patches: Now It's QuickTime's Turn

There's been a streak of security updates and issues for often-used products in the last few days. First was Microsoft's Patch Tuesday rush, and then that scrap about Internet Explorer and Firefox. Finally, Adobe patched holes in Flash Player.

Now, Apple just fixed eight security bugs ? seven of which I'd define as "critical" ? in QuickTime media player. The updated version is numbered 7.2.

Apple doesn't actually call them "critical." But when a threat description says that a successful exploit can result in "arbitrary code execution," that would seem to mean that a successful exploit would let someone else take over your PC. So that's my choice of word.

Software makers usually try to be vague enough in their discussion of how a bug works that they don't make crackers' jobs any easier or give anyone ideas. Apple is no different, and is even a bit more vague than some. But at least three of these bugs could bite you if you were to play booby-trapped movie files of different types ? including H.264 and .m4v format MP4 files.

A fourth flaw could be taken advantage of if you started up a malicious multimedia file written using the Synchronized Multimedia Integration Language (SMIL).

(I'll let you guess at how it's pronounced, but what it does is synchronize elements in a multimedia presentation. For instance, it could be used to write a script that shows a series of pictures one second each while "Happy Birthday" plays.)

The other three critical vulnerabilities Apple only characterizes as "design issues" so I'm not even going to guess at that. But it does say that you could be successfully attacked by merely visiting a site that hosts a malicious link. All in all, it's definitely an update worth getting.

There are updates for the Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Windows Vista, and Windows XP Service Pack 2.

If you don't have your software update preferences set to automatically download and install updates, you can get the download manually.

For more information and links to the downloads check out Apple's security bulletin.

Comments