TUCoPS :: Macintosh :: bx2668.htm

TUCoPS :: Macintosh :: bx2668.htm
Apple QuickTime Clipping Region Heap Overflow Vulnerability
ZDI-08-015: Apple QuickTime Clipping Region Heap Overflow Vulnerability ZDI-08-015: Apple QuickTime Clipping Region Heap Overflow Vulnerability

WkRJLTA4LTAxNTogQXBwbGUgUXVpY2tUaW1lIENsaXBwaW5nIFJlZ2lvbiBIZWFwIE92ZXJmbG93
IFZ1bG5lcmFiaWxpdHkNCmh0dHA6Ly93d3cuemVyb2RheWluaXRpYXRpdmUuY29tL2Fkdmlzb3Jp
ZXMvWkRJLTA4LTAxNQ0KQXByaWwgMywgMjAwOA0KDQotLSBDVkUgSUQ6DQpDVkUtMjAwOC0xMDE3
DQoNCi0tIEFmZmVjdGVkIFZlbmRvcnM6DQpBcHBsZQ0KDQotLSBBZmZlY3RlZCBQcm9kdWN0czoN
CkFwcGxlIFF1aWNrdGltZSA3LjQuMQ0KDQotLSBUaXBwaW5nUG9pbnQoVE0pIElQUyBDdXN0b21l
ciBQcm90ZWN0aW9uOg0KVGlwcGluZ1BvaW50IElQUyBjdXN0b21lcnMgaGF2ZSBiZWVuIHByb3Rl
Y3RlZCBhZ2FpbnN0IHRoaXMNCnZ1bG5lcmFiaWxpdHkgYnkgRGlnaXRhbCBWYWNjaW5lIHByb3Rl
Y3Rpb24gZmlsdGVyIElEIDU5MzEuIA0KRm9yIGZ1cnRoZXIgcHJvZHVjdCBpbmZvcm1hdGlvbiBv
biB0aGUgVGlwcGluZ1BvaW50IElQUywgdmlzaXQ6DQoNCiAgICBodHRwOi8vd3d3LnRpcHBpbmdw
b2ludC5jb20NCg0KLS0gVnVsbmVyYWJpbGl0eSBEZXRhaWxzOg0KVGhpcyB2dWxuZXJhYmlsaXR5
IGFsbG93cyBhdHRhY2tlcnMgdG8gZXhlY3V0ZSBhcmJpdHJhcnkgY29kZSBvbg0KdnVsbmVyYWJs
ZSBpbnN0YWxsYXRpb25zIG9mIEFwcGxlIFF1aWNrVGltZSBQbGF5ZXIuIFVzZXIgaW50ZXJhY3Rp
b24gaXMNCnJlcXVpcmVkIHRvIGV4cGxvaXQgdGhpcyB2dWxuZXJhYmlsaXR5IGluIHRoYXQgdGhl
IHRhcmdldCBtdXN0IHZpc2l0IGENCm1hbGljaW91cyBwYWdlIG9yIG9wZW4gYSBtYWxpY2lvdXMg
ZmlsZS4NCg0KVGhlIHNwZWNpZmljIGZsYXcgZXhpc3RzIHdpdGhpbiB0aGUgcXVpY2t0aW1lLnF0
cyBsaWJyYXJ5LiBUaGUNCnZ1bG5lcmFiaWxpdHkgcmVzaWRlcyBpbiB0aGUgY29tcG9uZW50J3Mg
cGFyc2luZyBvZiAnY3JnbicgYXRvbXMuIEEgbGFjaw0Kb2YgcHJvcGVyIHNhbml0eSBjaGVja3Mg
b24gdGhlIHJlZ2lvbiBzaXplIGZpZWxkIGNhbiByZXN1bHQgaW4gYSBoZWFwDQpiYXNlZCBidWZm
ZXIgb3ZlcmZsb3cgbGVhZGluZyB0byBhcmJpdHJhcnkgY29kZSBleGVjdXRpb24gdW5kZXIgdGhl
DQpjb250ZXh0IG9mIHRoZSBjdXJyZW50bHkgbG9nZ2VkIGluIHVzZXIuDQoNCi0tIFZlbmRvciBS
ZXNwb25zZToNCkFwcGxlIGhhcyBpc3N1ZWQgYW4gdXBkYXRlIHRvIGNvcnJlY3QgdGhpcyB2dWxu
ZXJhYmlsaXR5LiBNb3JlDQpkZXRhaWxzIGNhbiBiZSBmb3VuZCBhdDoNCg0KaHR0cDovL3N1cHBv
cnQuYXBwbGUuY29tL2tiL0hUMTI0MQ0KDQotLSBEaXNjbG9zdXJlIFRpbWVsaW5lOg0KMjAwOC0w
Mi0wNyAtIFZ1bG5lcmFiaWxpdHkgcmVwb3J0ZWQgdG8gdmVuZG9yDQoyMDA4LTA0LTAzIC0gQ29v
cmRpbmF0ZWQgcHVibGljIHJlbGVhc2Ugb2YgYWR2aXNvcnkNCg0KLS0gQ3JlZGl0Og0KVGhpcyB2
dWxuZXJhYmlsaXR5IHdhcyBkaXNjb3ZlcmVkIGJ5Og0KICAgICogU2FuYmluIExpDQoNCi0tIEFi
b3V0IHRoZSBaZXJvIERheSBJbml0aWF0aXZlIChaREkpOg0KRXN0YWJsaXNoZWQgYnkgVGlwcGlu
Z1BvaW50LCBUaGUgWmVybyBEYXkgSW5pdGlhdGl2ZSAoWkRJKSByZXByZXNlbnRzIA0KYSBiZXN0
LW9mLWJyZWVkIG1vZGVsIGZvciByZXdhcmRpbmcgc2VjdXJpdHkgcmVzZWFyY2hlcnMgZm9yIHJl
c3BvbnNpYmx5DQpkaXNjbG9zaW5nIGRpc2NvdmVyZWQgdnVsbmVyYWJpbGl0aWVzLg0KDQpSZXNl
YXJjaGVycyBpbnRlcmVzdGVkIGluIGdldHRpbmcgcGFpZCBmb3IgdGhlaXIgc2VjdXJpdHkgcmVz
ZWFyY2gNCnRocm91Z2ggdGhlIFpESSBjYW4gZmluZCBtb3JlIGluZm9ybWF0aW9uIGFuZCBzaWdu
LXVwIGF0Og0KDQogICAgaHR0cDovL3d3dy56ZXJvZGF5aW5pdGlhdGl2ZS5jb20NCg0KVGhlIFpE
SSBpcyB1bmlxdWUgaW4gaG93IHRoZSBhY3F1aXJlZCB2dWxuZXJhYmlsaXR5IGluZm9ybWF0aW9u
IGlzDQp1c2VkLiBUaXBwaW5nUG9pbnQgZG9lcyBub3QgcmUtc2VsbCB0aGUgdnVsbmVyYWJpbGl0
eSBkZXRhaWxzIG9yIGFueQ0KZXhwbG9pdCBjb2RlLiBJbnN0ZWFkLCB1cG9uIG5vdGlmeWluZyB0
aGUgYWZmZWN0ZWQgcHJvZHVjdCB2ZW5kb3IsDQpUaXBwaW5nUG9pbnQgcHJvdmlkZXMgaXRzIGN1
c3RvbWVycyB3aXRoIHplcm8gZGF5IHByb3RlY3Rpb24gdGhyb3VnaA0KaXRzIGludHJ1c2lvbiBw
cmV2ZW50aW9uIHRlY2hub2xvZ3kuIEV4cGxpY2l0IGRldGFpbHMgcmVnYXJkaW5nIHRoZQ0Kc3Bl
Y2lmaWNzIG9mIHRoZSB2dWxuZXJhYmlsaXR5IGFyZSBub3QgZXhwb3NlZCB0byBhbnkgcGFydGll
cyB1bnRpbA0KYW4gb2ZmaWNpYWwgdmVuZG9yIHBhdGNoIGlzIHB1YmxpY2x5IGF2YWlsYWJsZS4g
RnVydGhlcm1vcmUsIHdpdGggdGhlDQphbHRydWlzdGljIGFpbSBvZiBoZWxwaW5nIHRvIHNlY3Vy
ZSBhIGJyb2FkZXIgdXNlciBiYXNlLCBUaXBwaW5nUG9pbnQNCnByb3ZpZGVzIHRoaXMgdnVsbmVy
YWJpbGl0eSBpbmZvcm1hdGlvbiBjb25maWRlbnRpYWxseSB0byBzZWN1cml0eQ0KdmVuZG9ycyAo
aW5jbHVkaW5nIGNvbXBldGl0b3JzKSB3aG8gaGF2ZSBhIHZ1bG5lcmFiaWxpdHkgcHJvdGVjdGlv
biBvcg0KbWl0aWdhdGlvbiBwcm9kdWN0Lg0KDQpPdXIgdnVsbmVyYWJpbGl0eSBkaXNjbG9zdXJl
IHBvbGljeSBpcyBhdmFpbGFibGUgb25saW5lIGF0Og0KDQogICAgaHR0cDovL3d3dy56ZXJvZGF5
aW5pdGlhdGl2ZS5jb20vYWR2aXNvcmllcy9kaXNjbG9zdXJlX3BvbGljeS8NCg0KQ09ORklERU5U
SUFMSVRZIE5PVElDRTogVGhpcyBlLW1haWwgbWVzc2FnZSwgaW5jbHVkaW5nIGFueSBhdHRhY2ht
ZW50cywNCmlzIGJlaW5nIHNlbnQgYnkgM0NvbSBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBpbnRl
bmRlZCByZWNpcGllbnQocykgYW5kDQptYXkgY29udGFpbiBjb25maWRlbnRpYWwsIHByb3ByaWV0
YXJ5IGFuZC9vciBwcml2aWxlZ2VkIGluZm9ybWF0aW9uLg0KQW55IHVuYXV0aG9yaXplZCByZXZp
ZXcsIHVzZSwgZGlzY2xvc3VyZSBhbmQvb3IgZGlzdHJpYnV0aW9uIGJ5IGFueSANCnJlY2lwaWVu
dCBpcyBwcm9oaWJpdGVkLiAgSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwg
cGxlYXNlDQpkZWxldGUgYW5kL29yIGRlc3Ryb3kgYWxsIGNvcGllcyBvZiB0aGlzIG1lc3NhZ2Ug
cmVnYXJkbGVzcyBvZiBmb3JtIGFuZA0KYW55IGluY2x1ZGVkIGF0dGFjaG1lbnRzIGFuZCBub3Rp
ZnkgM0NvbSBpbW1lZGlhdGVseSBieSBjb250YWN0aW5nIHRoZQ0Kc2VuZGVyIHZpYSByZXBseSBl
LW1haWwgb3IgZm9yd2FyZGluZyB0byAzQ29tIGF0IHBvc3RtYXN0ZXJAM2NvbS5jb20uIA0K