Alert GCSA-06017 - Vulnerabilita' in Apple QuickTime

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


*****************************************************************************

      Alert ID : GCSA-06017
          Data : 15 Maggio 2006
        Titolo : Vulnerabilita' multiple in Apple QuickTime

*****************************************************************************

1) Descrizione del problema:

      Vulnerabilita' multiple di tipo integer overflow e buffer overflow
      interessano QuickTime. Questi difetti riguardano sia le versioni per
      Mac OS X che quelle per Microsoft Windows.

2) Piattaforme e Software interessati:

      Apple QuickTime Player 6, 6.1, 6.5, 6.5.1, 6.5.2
      Apple QuickTime Player 7.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4

      Package non vulnerabili: Apple QuickTime Player 7.1

3) Impatto:

      Esecuzione di codice arbitrario.
      Denial of Service.

4) Soluzioni:

      Aggiornare il prodotto alla versione 7.1

      http://www.apple.com/quicktime/download/win.html


5) Riferimenti:

      Apple - About the security content of the QuickTime 7.1 Update
      http://docs.info.apple.com/article.html?artnum=303752

      Mitre's CVE ID:
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1249
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1453
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1454
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1458
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1459
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1460
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1461
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1462
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1463
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1464
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1465
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2238

      Bugtraq ID: 17953
      http://www.securityfocus.com/bid/17953
      http://www.securityfocus.com/archive/1/433828
      http://www.securityfocus.com/archive/1/433831

-----BEGIN PGP SIGNATURE-----

iQCVAwUBRGhYC/OB+SpikaiRAQJYXwP/Zhuk0fobq35BowC2P+ZNe9KmlA8Fb/4q
weIyo1SNzXgQQSLdBSkZw0FlI2hgK0qRGG8XWZGnM4LjSKueNmFGhTmlg5qbWMF/
i8kuxiN2tv/jPo09CjtIZ2dG9gofJc37qRGRKwwZ2IXjbYwvrCO08dCF4nIY7jvm
KDkS/jdE8Vc=
=qgxX
-----END PGP SIGNATURE-----