Critical Denial of Service Vulnerabilities in libquicktime Package
Summary
USN-4545-1: libquicktime vulnerabilities. Affects libquicktime versions < 2:1.2.4-7+deb8u1ubuntu0.1. Fixed in 2:1.2.4-7+deb8u1ubuntu0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libquicktime is an open-source library designed for reading and writing QuickTime files. It is widely used in multimedia applications to handle video and audio data. However, certain versions of this package are vulnerable to multiple denial of service attacks due to improper handling of malformed MP4 files, which can lead to application crashes and resource exhaustion.
Vulnerability Detail
The vulnerabilities in libquicktime stem from its failure to correctly process malformed MP4 files. Attackers can exploit this by tricking users into opening specially crafted files, leading to crashes and denial of service. The identified CVEs (CVE-2017-9122, CVE-2017-9123, CVE-2017-9124, CVE-2017-9125, CVE-2017-9126, CVE-2017-9127, CVE-2017-9128) highlight various aspects of this issue, including resource exhaustion and application instability.
How To Fix
Minimum fixed version
2:1.2.4-7+deb8u1ubuntu0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libquicktimeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted MP4 files or disable the use of libquicktime in applications that allow for file type configuration until the package is updated.
Conclusion
The libquicktime package has critical vulnerabilities that can lead to denial of service through the exploitation of malformed MP4 files. Users are strongly advised to update to the latest patched version to ensure system stability and security.
See every vulnerability recorded for libquicktime →
FAQ
libquicktime is a library for handling QuickTime multimedia files, allowing applications to read and write video and audio data.
Exploiting these vulnerabilities can lead to application crashes and denial of service, impacting user experience and system stability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, a patched version of libquicktime is available. Users should update to version 2:1.2.4-7+deb8u1ubuntu0.1 to mitigate the vulnerabilities.
If immediate updates are not possible, avoid opening untrusted MP4 files and consider disabling libquicktime in your applications.
Related vulnerabilities
Recent vulnerabilities recorded for libquicktime.
