Security Update for libquicktime
Summary
DLA-1042-1: libquicktime - security update. Affects libquicktime versions < 2:1.2.4-3+deb7u2. Fixed in 2:1.2.4-3+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libquicktime is a library for reading and writing QuickTime files. It provides a set of functions and utilities to handle multimedia data in the QuickTime file format. This library is widely used in various applications for video playback and editing. However, it has been discovered that libquicktime versions prior to 2:1.2.4-3+deb7u2 are vulnerable to multiple security issues.
Vulnerability Detail
The vulnerabilities in libquicktime versions prior to 2:1.2.4-3+deb7u2 include:
-
CVE-2017-9122: The quicktime_read_moov function in moov.c allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.
-
CVE-2017-9123: The lqt_frame_duration function in lqt_quicktime.c allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.
-
CVE-2017-9124: The quicktime_match_32 function in util.c allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
-
CVE-2017-9125: The lqt_frame_duration function in lqt_quicktime.c allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mp4 file.
-
CVE-2017-9126: The quicktime_read_dref_table function in dref.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.
-
CVE-2017-9127: The quicktime_user_atoms_read_atom function in useratoms.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.
-
CVE-2017-9128: The quicktime_video_width function in lqt_quicktime.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.
These vulnerabilities can be exploited by an attacker to cause a denial of service or potentially execute arbitrary code.
How To Fix
Minimum fixed version
2:1.2.4-3+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libquicktimeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
libquicktime versions prior to 2:1.2.4-3+deb7u2 are vulnerable to multiple security issues. To ensure the security of your system, it is crucial to upgrade the libquicktime package to the latest version. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libquicktime →
FAQ
libquicktime is a library for reading and writing QuickTime files. It is commonly used in applications for video playback and editing.
The vulnerabilities in libquicktime include denial of service and potential arbitrary code execution.
These vulnerabilities can be exploited by an attacker through a crafted mp4 file.
The impact of these vulnerabilities can range from denial of service to potential arbitrary code execution.
To fix these vulnerabilities, it is recommended to upgrade the libquicktime package to version 2:1.2.4-3+deb7u2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for libquicktime.
