TUCoPS :: Apple(multi)

TUCoPS :: Apple(multi) :: va1207.htm
Apple QuickTime AVC1 Atom Parsing Heap Overflow Vulnerability
ZDI-08-060: Apple QuickTime AVC1 Atom Parsing Heap Overflow Vulnerability ZDI-08-060: Apple QuickTime AVC1 Atom Parsing Heap Overflow Vulnerability

WkRJLTA4LTA2MDogQXBwbGUgUXVpY2tUaW1lIEFWQzEgQXRvbSBQYXJzaW5nIEhlYXAgT3ZlcmZs
b3cgVnVsbmVyYWJpbGl0eQ0KaHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20vYWR2aXNv
cmllcy9aREktMDgtMDYwDQpTZXB0ZW1iZXIgOSwgMjAwOA0KDQotLSBDVkUgSUQ6DQpDVkUtMjAw
OC0zNjI3DQoNCi0tIEFmZmVjdGVkIFZlbmRvcnM6DQpBcHBsZQ0KDQotLSBBZmZlY3RlZCBQcm9k
dWN0czoNCkFwcGxlIFF1aWNrdGltZQ0KDQotLSBUaXBwaW5nUG9pbnQoVE0pIElQUyBDdXN0b21l
ciBQcm90ZWN0aW9uOg0KVGlwcGluZ1BvaW50IElQUyBjdXN0b21lcnMgaGF2ZSBiZWVuIHByb3Rl
Y3RlZCBhZ2FpbnN0IHRoaXMNCnZ1bG5lcmFiaWxpdHkgYnkgRGlnaXRhbCBWYWNjaW5lIHByb3Rl
Y3Rpb24gZmlsdGVyIElEIDYxNjkuIA0KRm9yIGZ1cnRoZXIgcHJvZHVjdCBpbmZvcm1hdGlvbiBv
biB0aGUgVGlwcGluZ1BvaW50IElQUywgdmlzaXQ6DQoNCiAgICBodHRwOi8vd3d3LnRpcHBpbmdw
b2ludC5jb20NCg0KLS0gVnVsbmVyYWJpbGl0eSBEZXRhaWxzOg0KVGhpcyB2dWxuZXJhYmlsaXR5
IGFsbG93cyBhdHRhY2tlcnMgdG8gZXhlY3V0ZSBhcmJpdHJhcnkgY29kZSBvbg0KdnVsbmVyYWJs
ZSBpbnN0YWxsYXRpb25zIG9mIEFwcGxlIFF1aWNrVGltZSBQbGF5ZXIuIFVzZXIgaW50ZXJhY3Rp
b24gaXMNCnJlcXVpcmVkIHRvIGV4cGxvaXQgdGhpcyB2dWxuZXJhYmlsaXR5IGluIHRoYXQgdGhl
IHRhcmdldCBtdXN0IHZpc2l0IGENCm1hbGljaW91cyBwYWdlIG9yIG9wZW4gYSBtYWxpY2lvdXMg
ZmlsZS4NCg0KVGhlIHNwZWNpZmljIGZsYXcgZXhpc3RzIGluIHRoZSBwYXJzaW5nIG9mIEFWQzEg
YXRvbXMuIEFuIGludGVnZXINCm92ZXJmbG93IGNvbmRpdGlvbiBpcyBwcmVzZW50IHRoYXQgY2Fu
IHJlc3VsdCBpbiBhIGhlYXAgY2h1bmsgYmVpbmcNCnVuZGVyLWFsbG9jYXRlZC4gVGhpcyBoZWFw
IGNvcnJ1cHRpb24gY2FuIGJlIGZ1cnRoZXIgbGV2ZXJhZ2VkIHRvDQpleGVjdXRlIGFyYml0cmFy
eSBjb2RlIHVuZGVyIHRoZSBjb250ZXh0IG9mIHRoZSBjdXJyZW50IHVzZXIuDQoNCi0tIFZlbmRv
ciBSZXNwb25zZToNCkFwcGxlIGhhcyBpc3N1ZWQgYW4gdXBkYXRlIHRvIGNvcnJlY3QgdGhpcyB2
dWxuZXJhYmlsaXR5LiBNb3JlDQpkZXRhaWxzIGNhbiBiZSBmb3VuZCBhdDoNCg0KaHR0cDovL3N1
cHBvcnQuYXBwbGUuY29tL2tiL0hUMzAyNw0KDQotLSBEaXNjbG9zdXJlIFRpbWVsaW5lOg0KMjAw
OC0wNS0xNSAtIFZ1bG5lcmFiaWxpdHkgcmVwb3J0ZWQgdG8gdmVuZG9yDQoyMDA4LTA5LTA5IC0g
Q29vcmRpbmF0ZWQgcHVibGljIHJlbGVhc2Ugb2YgYWR2aXNvcnkNCg0KLS0gQ3JlZGl0Og0KVGhp
cyB2dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVkIGJ5Og0KICAgICogQW5vbnltb3VzDQoNCi0t
IEFib3V0IHRoZSBaZXJvIERheSBJbml0aWF0aXZlIChaREkpOg0KRXN0YWJsaXNoZWQgYnkgVGlw
cGluZ1BvaW50LCBUaGUgWmVybyBEYXkgSW5pdGlhdGl2ZSAoWkRJKSByZXByZXNlbnRzIA0KYSBi
ZXN0LW9mLWJyZWVkIG1vZGVsIGZvciByZXdhcmRpbmcgc2VjdXJpdHkgcmVzZWFyY2hlcnMgZm9y
IHJlc3BvbnNpYmx5DQpkaXNjbG9zaW5nIGRpc2NvdmVyZWQgdnVsbmVyYWJpbGl0aWVzLg0KDQpS
ZXNlYXJjaGVycyBpbnRlcmVzdGVkIGluIGdldHRpbmcgcGFpZCBmb3IgdGhlaXIgc2VjdXJpdHkg
cmVzZWFyY2gNCnRocm91Z2ggdGhlIFpESSBjYW4gZmluZCBtb3JlIGluZm9ybWF0aW9uIGFuZCBz
aWduLXVwIGF0Og0KDQogICAgaHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20NCg0KVGhl
IFpESSBpcyB1bmlxdWUgaW4gaG93IHRoZSBhY3F1aXJlZCB2dWxuZXJhYmlsaXR5IGluZm9ybWF0
aW9uIGlzDQp1c2VkLiBUaXBwaW5nUG9pbnQgZG9lcyBub3QgcmUtc2VsbCB0aGUgdnVsbmVyYWJp
bGl0eSBkZXRhaWxzIG9yIGFueQ0KZXhwbG9pdCBjb2RlLiBJbnN0ZWFkLCB1cG9uIG5vdGlmeWlu
ZyB0aGUgYWZmZWN0ZWQgcHJvZHVjdCB2ZW5kb3IsDQpUaXBwaW5nUG9pbnQgcHJvdmlkZXMgaXRz
IGN1c3RvbWVycyB3aXRoIHplcm8gZGF5IHByb3RlY3Rpb24gdGhyb3VnaA0KaXRzIGludHJ1c2lv
biBwcmV2ZW50aW9uIHRlY2hub2xvZ3kuIEV4cGxpY2l0IGRldGFpbHMgcmVnYXJkaW5nIHRoZQ0K
c3BlY2lmaWNzIG9mIHRoZSB2dWxuZXJhYmlsaXR5IGFyZSBub3QgZXhwb3NlZCB0byBhbnkgcGFy
dGllcyB1bnRpbA0KYW4gb2ZmaWNpYWwgdmVuZG9yIHBhdGNoIGlzIHB1YmxpY2x5IGF2YWlsYWJs
ZS4gRnVydGhlcm1vcmUsIHdpdGggdGhlDQphbHRydWlzdGljIGFpbSBvZiBoZWxwaW5nIHRvIHNl
Y3VyZSBhIGJyb2FkZXIgdXNlciBiYXNlLCBUaXBwaW5nUG9pbnQNCnByb3ZpZGVzIHRoaXMgdnVs
bmVyYWJpbGl0eSBpbmZvcm1hdGlvbiBjb25maWRlbnRpYWxseSB0byBzZWN1cml0eQ0KdmVuZG9y
cyAoaW5jbHVkaW5nIGNvbXBldGl0b3JzKSB3aG8gaGF2ZSBhIHZ1bG5lcmFiaWxpdHkgcHJvdGVj
dGlvbiBvcg0KbWl0aWdhdGlvbiBwcm9kdWN0Lg0KDQpPdXIgdnVsbmVyYWJpbGl0eSBkaXNjbG9z
dXJlIHBvbGljeSBpcyBhdmFpbGFibGUgb25saW5lIGF0Og0KDQogICAgaHR0cDovL3d3dy56ZXJv
ZGF5aW5pdGlhdGl2ZS5jb20vYWR2aXNvcmllcy9kaXNjbG9zdXJlX3BvbGljeS8NCg0KQ09ORklE
RU5USUFMSVRZIE5PVElDRTogVGhpcyBlLW1haWwgbWVzc2FnZSwgaW5jbHVkaW5nIGFueSBhdHRh
Y2htZW50cywNCmlzIGJlaW5nIHNlbnQgYnkgM0NvbSBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBp
bnRlbmRlZCByZWNpcGllbnQocykgYW5kDQptYXkgY29udGFpbiBjb25maWRlbnRpYWwsIHByb3By
aWV0YXJ5IGFuZC9vciBwcml2aWxlZ2VkIGluZm9ybWF0aW9uLg0KQW55IHVuYXV0aG9yaXplZCBy
ZXZpZXcsIHVzZSwgZGlzY2xvc3VyZSBhbmQvb3IgZGlzdHJpYnV0aW9uIGJ5IGFueSANCnJlY2lw
aWVudCBpcyBwcm9oaWJpdGVkLiAgSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVu
dCwgcGxlYXNlDQpkZWxldGUgYW5kL29yIGRlc3Ryb3kgYWxsIGNvcGllcyBvZiB0aGlzIG1lc3Nh
Z2UgcmVnYXJkbGVzcyBvZiBmb3JtIGFuZA0KYW55IGluY2x1ZGVkIGF0dGFjaG1lbnRzIGFuZCBu
b3RpZnkgM0NvbSBpbW1lZGlhdGVseSBieSBjb250YWN0aW5nIHRoZQ0Kc2VuZGVyIHZpYSByZXBs
eSBlLW1haWwgb3IgZm9yd2FyZGluZyB0byAzQ29tIGF0IHBvc3RtYXN0ZXJAM2NvbS5jb20uIA0K