Some vulnerabilities have been reported in Apple QuickTime, which potentially can be exploited by malicious people to compromise a user's system.

1) An integer overflow error exists in the handling of 3GP video files.

NOTE: This does not affect QuickTime on Mac OS X.

2) A boundary error in the handling of MIDI files can be exploited to cause a heap-based buffer overflow.

3) A boundary error in the handling of QuickTime movie files can be exploited to cause a heap-based buffer overflow.

4) An integer overflow exists in the processing of UDTA atom size values in movie files, which can be exploited to corrupt heap memory.

5) A boundary error in the handling of PICT files can be exploited to cause a heap-based buffer overflow.

6) A boundary error in the handling of QTIF files can be exploited to cause a stack-based buffer overflow.

7) An integer overflow exists in the handling of QTIF files.

8) An input validation error exists in the processing of QTIF files. This can be exploited to cause a heap corruption via a specially crafted QTIF file with the "Color Table ID" field set to "0".

9) A boundary error within the processing of Jpeg 2000 files can be exploited to cause a stack-based buffer overflow via a specially crafted JP2 file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Solution
Update to version 7.1.5.
Further details available in Customer Area

Provided and/or discovered by
1) JJ Reyes
2,5,6,7) Mike Price, McAfee AVERT Labs
3) Mike Price, McAfee AVERT Labs, Piotr Bania, and Artur Ogloza
4) Sowhat of Nevis Labs and an anonymous researcher via ZDI.
8) Ruben Santamarta via iDefense and JJ Reyes
9) Silent fix noticed by Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
Apple:
http://docs.info.apple.com/article.html?artnum=305149

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=486

Piotr Bania:
http://www.piotrbania.com/all/adv/quicktime-heap-adv-7.1.txt

Reverse Mode:
http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=46

Sowhat:
http://secway.org/advisory/AD20070306.txt

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-010.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area