iDefense Security Advisory 01.15.08 – Remote exploitation of a heap corruption vulnerability in Apple Computer Inc.’s QuickTime media player could allow attackers to execute arbitrary code in the context of the targeted user. The vulnerability specifically exists in the handling of Macintosh Resources embedded in QuickTime movies. When processing these records, a length value stored in the resource header is not properly validated. When a length value larger than the actual buffer size is supplied, potentially exploitable memory corruption occurs. iDefense Labs confirmed this vulnerability exists in QuickTime Player version 7.3.1. Previous versions are suspected to be vulnerable.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/62673/01.15.08-5.txt
Source: https://packetstormsecurity.com/files/62673/iDEFENSE-Security-Advisory-2008-01-15.5.html