TUCoPS :: Macintosh :: tb13292.htm

TUCoPS :: Macintosh :: tb13292.htm
Apple QuickTime Color Table RGB Parsing Heap Corruption Vulnerability
ZDI-07-065: Apple QuickTime Color Table RGB Parsing Heap Corruption Vulnerability ZDI-07-065: Apple QuickTime Color Table RGB Parsing Heap Corruption Vulnerability

WkRJLTA3LTA2NTogQXBwbGUgUXVpY2tUaW1lIENvbG9yIFRhYmxlIFJHQiBQYXJzaW5nIEhlYXAg
Q29ycnVwdGlvbiANClZ1bG5lcmFiaWxpdHkNCmh0dHA6Ly93d3cuemVyb2RheWluaXRpYXRpdmUu
Y29tL2Fkdmlzb3JpZXMvWkRJLTA3LTA2NS5odG1sDQpOb3ZlbWJlciAgNSwgMjAwNw0KDQotLSBD
VkUgSUQ6DQpDVkUtMjAwNy00Njc3DQoNCi0tIEFmZmVjdGVkIFZlbmRvcjoNCkFwcGxlDQoNCi0t
IEFmZmVjdGVkIFByb2R1Y3RzOg0KUXVpY2tUaW1lIDcuMg0KDQotLSBUaXBwaW5nUG9pbnQoVE0p
IElQUyBDdXN0b21lciBQcm90ZWN0aW9uOg0KVGlwcGluZ1BvaW50IElQUyBjdXN0b21lcnMgaGF2
ZSBiZWVuIHByb3RlY3RlZCBhZ2FpbnN0IHRoaXMNCnZ1bG5lcmFiaWxpdHkgYnkgRGlnaXRhbCBW
YWNjaW5lIHByb3RlY3Rpb24gZmlsdGVyIElEIDU2MTAuIA0KRm9yIGZ1cnRoZXIgcHJvZHVjdCBp
bmZvcm1hdGlvbiBvbiB0aGUgVGlwcGluZ1BvaW50IElQUzoNCg0KICAgIGh0dHA6Ly93d3cudGlw
cGluZ3BvaW50LmNvbSANCg0KLS0gVnVsbmVyYWJpbGl0eSBEZXRhaWxzOg0KVGhpcyB2dWxuZXJh
YmlsaXR5IGFsbG93cyByZW1vdGUgYXR0YWNrZXJzIHRvIGV4ZWN1dGUgYXJiaXRyYXJ5IGNvZGUg
b24NCnZ1bG5lcmFibGUgaW5zdGFsbGF0aW9ucyBvZiBBcHBsZSBRdWlja1RpbWUuIFVzZXIgaW50
ZXJhY3Rpb24gaXMNCnJlcXVpcmVkIHRvIGV4cGxvaXQgdGhpcyB2dWxuZXJhYmlsaXR5IGluIHRo
YXQgdGhlIHRhcmdldCBtdXN0IG9wZW4gYQ0KbWFsaWNpb3VzIGZpbGUuIA0KDQpUaGUgc3BlY2lm
aWMgZmxhdyBleGlzdHMgaW4gdGhlIHBhcnNpbmcgb2YgdGhlIENUQUIgYXRvbS4gV2hpbGUgcmVh
ZGluZw0KdGhlIENUQUIgUkdCIHZhbHVlcywgYW4gaW52YWxpZCBjb2xvciB0YWJsZSBzaXplIGNh
biBjYXVzZSBRdWlja1RpbWUgdG8NCndyaXRlIHBhc3QgdGhlIGVuZCBvZiB0aGUgaGVhcCBjaHVu
ay4gVGhpcyBtZW1vcnkgY29ycnVwdGlvbiBjYW4gbGVhZA0KdG8gdGhlIGV4ZWN1dGlvbiBvZiBh
cmJpdHJhcnkgY29kZS4NCg0KLS0gVmVuZG9yIFJlc3BvbnNlOg0KQXBwbGUgaGFzIGlzc3VlZCBh
biB1cGRhdGUgdG8gY29ycmVjdCB0aGlzIHZ1bG5lcmFiaWxpdHkuIE1vcmUgZGV0YWlscw0KY2Fu
IGJlIGZvdW5kIGF0Og0KDQpodHRwOi8vZG9jcy5pbmZvLmFwcGxlLmNvbS9hcnRpY2xlLmh0bWw/
YXJ0bnVtPTMwNjg5Ng0KDQotLSBEaXNjbG9zdXJlIFRpbWVsaW5lOg0KMjAwNy4wOS4xNCAtIFZ1
bG5lcmFiaWxpdHkgcmVwb3J0ZWQgdG8gdmVuZG9yDQoyMDA3LjExLjA1IC0gQ29vcmRpbmF0ZWQg
cHVibGljIHJlbGVhc2Ugb2YgYWR2aXNvcnkNCg0KLS0gQ3JlZGl0Og0KVGhpcyB2dWxuZXJhYmls
aXR5IHdhcyBkaXNjb3ZlcmVkIGJ5IFJ1YmVuIFNhbnRhbWFydGEgb2YgcmV2ZXJzZW1vZGUuY29t
IA0KYW5kDQpNYXJpbyBCYWxsYW5vIG9mIDQ4Yml0cy5jb20uDQoNCi0tIEFib3V0IHRoZSBaZXJv
IERheSBJbml0aWF0aXZlIChaREkpOg0KRXN0YWJsaXNoZWQgYnkgVGlwcGluZ1BvaW50LCBUaGUg
WmVybyBEYXkgSW5pdGlhdGl2ZSAoWkRJKSByZXByZXNlbnRzIA0KYSBiZXN0LW9mLWJyZWVkIG1v
ZGVsIGZvciByZXdhcmRpbmcgc2VjdXJpdHkgcmVzZWFyY2hlcnMgZm9yIHJlc3BvbnNpYmx5DQpk
aXNjbG9zaW5nIGRpc2NvdmVyZWQgdnVsbmVyYWJpbGl0aWVzLg0KDQpSZXNlYXJjaGVycyBpbnRl
cmVzdGVkIGluIGdldHRpbmcgcGFpZCBmb3IgdGhlaXIgc2VjdXJpdHkgcmVzZWFyY2gNCnRocm91
Z2ggdGhlIFpESSBjYW4gZmluZCBtb3JlIGluZm9ybWF0aW9uIGFuZCBzaWduLXVwIGF0Og0KDQog
ICAgaHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20NCg0KVGhlIFpESSBpcyB1bmlxdWUg
aW4gaG93IHRoZSBhY3F1aXJlZCB2dWxuZXJhYmlsaXR5IGluZm9ybWF0aW9uIGlzIHVzZWQuDQoz
Q29tIGRvZXMgbm90IHJlLXNlbGwgdGhlIHZ1bG5lcmFiaWxpdHkgZGV0YWlscyBvciBhbnkgZXhw
bG9pdCBjb2RlLg0KSW5zdGVhZCwgdXBvbiBub3RpZnlpbmcgdGhlIGFmZmVjdGVkIHByb2R1Y3Qg
dmVuZG9yLCAzQ29tIHByb3ZpZGVzIGl0cw0KY3VzdG9tZXJzIHdpdGggemVybyBkYXkgcHJvdGVj
dGlvbiB0aHJvdWdoIGl0cyBpbnRydXNpb24gcHJldmVudGlvbg0KdGVjaG5vbG9neS4gRXhwbGlj
aXQgZGV0YWlscyByZWdhcmRpbmcgdGhlIHNwZWNpZmljcyBvZiB0aGUNCnZ1bG5lcmFiaWxpdHkg
YXJlIG5vdCBleHBvc2VkIHRvIGFueSBwYXJ0aWVzIHVudGlsIGFuIG9mZmljaWFsIHZlbmRvcg0K
cGF0Y2ggaXMgcHVibGljbHkgYXZhaWxhYmxlLiBGdXJ0aGVybW9yZSwgd2l0aCB0aGUgYWx0cnVp
c3RpYyBhaW0gb2YNCmhlbHBpbmcgdG8gc2VjdXJlIGEgYnJvYWRlciB1c2VyIGJhc2UsIDNDb20g
cHJvdmlkZXMgdGhpcyB2dWxuZXJhYmlsaXR5DQppbmZvcm1hdGlvbiBjb25maWRlbnRpYWxseSB0
byBzZWN1cml0eSB2ZW5kb3JzIChpbmNsdWRpbmcgY29tcGV0aXRvcnMpDQp3aG8gaGF2ZSBhIHZ1
bG5lcmFiaWxpdHkgcHJvdGVjdGlvbiBvciBtaXRpZ2F0aW9uIHByb2R1Y3QuDQoNCkNPTkZJREVO
VElBTElUWSBOT1RJQ0U6IFRoaXMgZS1tYWlsIG1lc3NhZ2UsIGluY2x1ZGluZyBhbnkgYXR0YWNo
bWVudHMsDQppcyBiZWluZyBzZW50IGJ5IDNDb20gZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50
ZW5kZWQgcmVjaXBpZW50KHMpIGFuZA0KbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsLCBwcm9wcmll
dGFyeSBhbmQvb3IgcHJpdmlsZWdlZCBpbmZvcm1hdGlvbi4NCkFueSB1bmF1dGhvcml6ZWQgcmV2
aWV3LCB1c2UsIGRpc2Nsb3N1cmUgYW5kL29yIGRpc3RyaWJ1dGlvbiBieSBhbnkgDQpyZWNpcGll
bnQgaXMgcHJvaGliaXRlZC4gIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQs
IHBsZWFzZQ0KZGVsZXRlIGFuZC9vciBkZXN0cm95IGFsbCBjb3BpZXMgb2YgdGhpcyBtZXNzYWdl
IHJlZ2FyZGxlc3Mgb2YgZm9ybSBhbmQNCmFueSBpbmNsdWRlZCBhdHRhY2htZW50cyBhbmQgbm90
aWZ5IDNDb20gaW1tZWRpYXRlbHkgYnkgY29udGFjdGluZyB0aGUNCnNlbmRlciB2aWEgcmVwbHkg
ZS1tYWlsIG9yIGZvcndhcmRpbmcgdG8gM0NvbSBhdCBwb3N0bWFzdGVyQDNjb20uY29tLiANCg=