The QuickTime vulnerability leaves users open to attack via a web page embedded with a specially-crafted streaming media file.
The malformed file targets a flaw in the multimedia tool's Remote Transfer Streaming Protocol (RTSP) component.
An attacker could cause QuickTime to crash and remotely execute code on the target system. The flaw was reported on 11 January by security researcher Luigi Auriemma.
This is not the first time Apple has had to patch a vulnerability in QuickTime's RTSP code. Another flaw led to a series of attacks in December.
Apple has also issued an update for iPhoto, the image organising and sharing application which is a standard component of the iLife suite for OS X.
The flaw could allow an attacker to create a malformed Photocast stream which would allow remote code execution on the system of all users who attempted to subscribe. Discovery of the vulnerability is credited to security researcher Nathan McFeters.
Both security updates can be downloaded through Apple's Software Update utility or from the Apple Downloads site.
Apple patches QuickTime and iPhoto flaws
Got a news tip for our journalists? Share it with us anonymously here.
Add techpartner.news as your trusted source
Partner Content
Cisco’s AI Rally Kit delivers high performance AI without the engineering pain
Now is the time for the channel to push the hardware refresh
In the memory market that AI just broke, here’s what you must do now
.jpg&h=142&w=230&c=1&s=1)
Distribution done differently: How Crayon, a SoftwareOne Company, is powering partner growth
.jpg&h=142&w=230&c=1&s=1)
Gamma invests to make Australian expansion a success
.jpg&w=100&c=1&s=0)
.jpg&w=100&c=1&s=0)
.jpg&w=100&c=1&s=0)
.jpg&w=100&c=1&s=0)
