TUCoPS :: Macintosh :: tb13294.htm

TUCoPS :: Macintosh :: tb13294.htm
Apple Quicktime PICT File PackBitsRgn Parsing Heap Corruption Vulnerability
ZDI-07-066: Apple Quicktime PICT File PackBitsRgn Parsing Heap Corruption Vulnerability ZDI-07-066: Apple Quicktime PICT File PackBitsRgn Parsing Heap Corruption Vulnerability

WkRJLTA3LTA2NjogQXBwbGUgUXVpY2t0aW1lIFBJQ1QgRmlsZSBQYWNrQml0c1JnbiBQYXJzaW5n
IEhlYXAgQ29ycnVwdGlvbiANClZ1bG5lcmFiaWxpdHkNCmh0dHA6Ly93d3cuemVyb2RheWluaXRp
YXRpdmUuY29tL2Fkdmlzb3JpZXMvWkRJLTA3LTA2Ni5odG1sDQpOb3ZlbWJlciAgNSwgMjAwNw0K
DQotLSBDVkUgSUQ6DQpDVkUtMjAwNy00Njc2DQoNCi0tIEFmZmVjdGVkIFZlbmRvcjoNCkFwcGxl
DQoNCi0tIEFmZmVjdGVkIFByb2R1Y3RzOg0KUXVpY2tUaW1lIDcuMg0KDQotLSBWdWxuZXJhYmls
aXR5IERldGFpbHM6DQpUaGlzIHZ1bG5lcmFiaWxpdHkgYWxsb3dzIGF0dGFja2VycyB0byBleGVj
dXRlIGFyYml0cmFyeSBjb2RlIG9uDQp2dWxuZXJhYmxlIGluc3RhbGxhdGlvbnMgb2YgQXBwbGUg
UXVpY2tUaW1lLiBVc2VyIGludGVyYWN0aW9uIGlzDQpyZXF1aXJlZCB0byBleHBsb2l0IHRoaXMg
dnVsbmVyYWJpbGl0eSBpbiB0aGF0IHRoZSB0YXJnZXQgbXVzdCB2aXNpdCBhDQptYWxpY2lvdXMg
cGFnZSBvciBvcGVuIGEgbWFsaWNpb3VzIGZpbGUuDQoNClRoZSBzcGVjaWZpYyBmbGF3IGV4aXN0
IGluIHRoZSBwYXJzaW5nIG9mIHRoZSBQYWNrQml0c1JnbiBmaWVsZCAoT3Bjb2RlDQoweDAwOTkp
LiBEdWUgdG8gaW1wcm9wZXIgaGFuZGxpbmcgb2YgYSBtYWxmb3JtZWQgZWxlbWVudCBpbiB0aGUN
CnN0cnVjdHVyZSwgaGVhcCBjb3JydXB0aW9uIG9jY3Vycy4gSWYgcHJvcGVybHkgY29uc3RydWN0
ZWQgdGhpcyBjYW4NCmxlYWQgdG8gY29kZSBleGVjdXRpb24gcnVubmluZyB1bmRlciB0aGUgY3Jl
ZGVudGlhbHMgb2YgdGhlIHVzZXIuDQoNCi0tIFZlbmRvciBSZXNwb25zZToNCkFwcGxlIGhhcyBp
c3N1ZWQgYW4gdXBkYXRlIHRvIGNvcnJlY3QgdGhpcyB2dWxuZXJhYmlsaXR5LiBNb3JlIGRldGFp
bHMNCmNhbiBiZSBmb3VuZCBhdDoNCg0KaHR0cDovL2RvY3MuaW5mby5hcHBsZS5jb20vYXJ0aWNs
ZS5odG1sP2FydG51bT0zMDY4OTYNCg0KLS0gRGlzY2xvc3VyZSBUaW1lbGluZToNCjIwMDcuMDku
MTQgLSBWdWxuZXJhYmlsaXR5IHJlcG9ydGVkIHRvIHZlbmRvcg0KMjAwNy4xMS4wNSAtIENvb3Jk
aW5hdGVkIHB1YmxpYyByZWxlYXNlIG9mIGFkdmlzb3J5DQoNCi0tIENyZWRpdDoNClRoaXMgdnVs
bmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieSBSdWJlbiBTYW50YW1hcnRhIG9mIHJldmVyc2Vt
b2RlLmNvbS4NCg0KLS0gQWJvdXQgdGhlIFplcm8gRGF5IEluaXRpYXRpdmUgKFpESSk6DQpFc3Rh
Ymxpc2hlZCBieSBUaXBwaW5nUG9pbnQsIFRoZSBaZXJvIERheSBJbml0aWF0aXZlIChaREkpIHJl
cHJlc2VudHMgDQphIGJlc3Qtb2YtYnJlZWQgbW9kZWwgZm9yIHJld2FyZGluZyBzZWN1cml0eSBy
ZXNlYXJjaGVycyBmb3IgcmVzcG9uc2libHkNCmRpc2Nsb3NpbmcgZGlzY292ZXJlZCB2dWxuZXJh
YmlsaXRpZXMuDQoNClJlc2VhcmNoZXJzIGludGVyZXN0ZWQgaW4gZ2V0dGluZyBwYWlkIGZvciB0
aGVpciBzZWN1cml0eSByZXNlYXJjaA0KdGhyb3VnaCB0aGUgWkRJIGNhbiBmaW5kIG1vcmUgaW5m
b3JtYXRpb24gYW5kIHNpZ24tdXAgYXQ6DQoNCiAgICBodHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0
aXZlLmNvbQ0KDQpUaGUgWkRJIGlzIHVuaXF1ZSBpbiBob3cgdGhlIGFjcXVpcmVkIHZ1bG5lcmFi
aWxpdHkgaW5mb3JtYXRpb24gaXMgdXNlZC4NCjNDb20gZG9lcyBub3QgcmUtc2VsbCB0aGUgdnVs
bmVyYWJpbGl0eSBkZXRhaWxzIG9yIGFueSBleHBsb2l0IGNvZGUuDQpJbnN0ZWFkLCB1cG9uIG5v
dGlmeWluZyB0aGUgYWZmZWN0ZWQgcHJvZHVjdCB2ZW5kb3IsIDNDb20gcHJvdmlkZXMgaXRzDQpj
dXN0b21lcnMgd2l0aCB6ZXJvIGRheSBwcm90ZWN0aW9uIHRocm91Z2ggaXRzIGludHJ1c2lvbiBw
cmV2ZW50aW9uDQp0ZWNobm9sb2d5LiBFeHBsaWNpdCBkZXRhaWxzIHJlZ2FyZGluZyB0aGUgc3Bl
Y2lmaWNzIG9mIHRoZQ0KdnVsbmVyYWJpbGl0eSBhcmUgbm90IGV4cG9zZWQgdG8gYW55IHBhcnRp
ZXMgdW50aWwgYW4gb2ZmaWNpYWwgdmVuZG9yDQpwYXRjaCBpcyBwdWJsaWNseSBhdmFpbGFibGUu
IEZ1cnRoZXJtb3JlLCB3aXRoIHRoZSBhbHRydWlzdGljIGFpbSBvZg0KaGVscGluZyB0byBzZWN1
cmUgYSBicm9hZGVyIHVzZXIgYmFzZSwgM0NvbSBwcm92aWRlcyB0aGlzIHZ1bG5lcmFiaWxpdHkN
CmluZm9ybWF0aW9uIGNvbmZpZGVudGlhbGx5IHRvIHNlY3VyaXR5IHZlbmRvcnMgKGluY2x1ZGlu
ZyBjb21wZXRpdG9ycykNCndobyBoYXZlIGEgdnVsbmVyYWJpbGl0eSBwcm90ZWN0aW9uIG9yIG1p
dGlnYXRpb24gcHJvZHVjdC4NCg0KQ09ORklERU5USUFMSVRZIE5PVElDRTogVGhpcyBlLW1haWwg
bWVzc2FnZSwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cywNCmlzIGJlaW5nIHNlbnQgYnkgM0Nv
bSBmb3IgdGhlIHNvbGUgdXNlIG9mIHRoZSBpbnRlbmRlZCByZWNpcGllbnQocykgYW5kDQptYXkg
Y29udGFpbiBjb25maWRlbnRpYWwsIHByb3ByaWV0YXJ5IGFuZC9vciBwcml2aWxlZ2VkIGluZm9y
bWF0aW9uLg0KQW55IHVuYXV0aG9yaXplZCByZXZpZXcsIHVzZSwgZGlzY2xvc3VyZSBhbmQvb3Ig
ZGlzdHJpYnV0aW9uIGJ5IGFueSANCnJlY2lwaWVudCBpcyBwcm9oaWJpdGVkLiAgSWYgeW91IGFy
ZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlDQpkZWxldGUgYW5kL29yIGRlc3Ry
b3kgYWxsIGNvcGllcyBvZiB0aGlzIG1lc3NhZ2UgcmVnYXJkbGVzcyBvZiBmb3JtIGFuZA0KYW55
IGluY2x1ZGVkIGF0dGFjaG1lbnRzIGFuZCBub3RpZnkgM0NvbSBpbW1lZGlhdGVseSBieSBjb250
YWN0aW5nIHRoZQ0Kc2VuZGVyIHZpYSByZXBseSBlLW1haWwgb3IgZm9yd2FyZGluZyB0byAzQ29t
IGF0IHBvc3RtYXN0ZXJAM2NvbS5jb20uIA0K