A vulnerability has been reported in Apple QuickTime, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error in "toQTPointer()" within the QuickTime Java extensions (QTJava.dll) and can be exploited to write arbitrary values to memory locations outside of an allocated buffer.

Successful exploitation allows execution of arbitrary code when a user visits a malicious web site using a Java-enabled browser e.g. Safari, Internet Explorer, or Firefox.

The vulnerability is reported on a Mac OS X system using Safari and Firefox. Other browsers and platforms may also be affected.

Solution
Update to QuickTime version 7.1.6.
Further details available to Secunia VIM customers

Provided and/or discovered by
Dino Dai Zovi

Changelog
Further details available to Secunia VIM customers

Original Advisory
Apple:
http://docs.info.apple.com/article.html?artnum=305446

Matasano:
http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-023.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers