The QuickTime vulnerability leaves users open to attack via a web page embedded with a specially-crafted streaming media file.
The malformed file targets a flaw in the multimedia tool's Remote Transfer Streaming Protocol (RTSP) component.
An attacker could cause QuickTime to crash and remotely execute code on the target system. The flaw was reported on 11 January by security researcher Luigi Auriemma.
This is not the first time Apple has had to patch a vulnerability in QuickTime's RTSP code. Another flaw led to a series of attacks in December.
Apple has also issued an update for iPhoto, the image organising and sharing application which is a standard component of the iLife suite for OS X.
The flaw could allow an attacker to create a malformed Photocast stream which would allow remote code execution on the system of all users who attempted to subscribe. Discovery of the vulnerability is credited to security researcher Nathan McFeters.
Both security updates can be downloaded through Apple's Software Update utility or from the Apple Downloads site.
Apple patches QuickTime and iPhoto flaws
Got a news tip for our journalists? Share it with us anonymously here.
Add techpartner.news as your trusted source
Partner Content
Now is the time for the channel to push the hardware refresh
Promoted Content
Jabra launches PanaCast U30 video bar for easier BYOD meetings
Expanding Opportunities for Microsoft Partners with Dicker Data’s Solution ConX Marketplace
.jpeg&h=142&w=230&c=1&s=1)
The next generation of Cloud-iQ: A platform built for the reality of running a modern reseller business
In the memory market that AI just broke, here’s what you must do now
