Apple flaw count for 2007: 111 and counting

Apple has slapped another patch on its QuickTime media player to plug two serious security vulnerabilities.

The QuickTime 7.1.6 update, available for both Mac and Windows users, addresses a pair of implementation flaws in QuickTime for Java, the architecture that provides APIs for developers to build multimedia into applications and applets.

The more serious of the two flaws could allow code injection attacks if a user is tricked into browsing to a malicious Web page.

The bug, reported by researchers from IBM ISS X-Force and Secunia, could allow instantiation or manipulation of objects outside the bounds of the allocated heap. "By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution," Apple said in an advisory.

The second flaw is a design issue n QuickTime for Java that could allow a Web browser's memory to be read by a Java applet.

"By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to the disclosure of sensitive information," Apple said.

The latest update brings the Apple patch count for 2007 up to 111.