Chkr_D591

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7.3 **Description** The issue is related to a use-after-free vulnerability in the plugin, which can be exploited by remote attackers through an HTML document with a crafted ` qtactivex ` parameter in an OBJECT element. This can lead to the execution of arbitrary code or cause a denial of service, resulting in an application crash. **Recommendations** For versions prior to 7.7.3, update to version 7.7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to HTML documents with crafted OBJECT elements until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7.3 **Description** The issue is related to a use-after-free vulnerability in the Clear method of the ActiveX control. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service, resulting in an application crash, via unspecified vectors. **Recommendations** For versions prior to 7.7.3, update to version 7.7.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7.2 **Description** The issue is related to a stack-based buffer overflow in the plugin, which can be triggered by a crafted QTMovie object. This can allow remote attackers to execute arbitrary code or cause the application to crash. **Recommendations** For versions prior to 7.7.2, update to version 7.7.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime versions prior to 7.7 **Description** The issue is related to a stack-based buffer overflow in the QuickTime ActiveX control when used with Internet Explorer, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted QTL file. **Recommendations** For versions prior to 7.7, update to version 7.7 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Internet Explorer with QuickTime until the update is applied. Restrict access to crafted QTL files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.1.4 RealPlayer Enterprise version 2.1.2 **Description** The issue arises from an ActiveX control in RealPlayer that fails to properly initialize an object component when parsing a CDDA URI. This can be exploited by remote attackers to execute arbitrary code or cause a denial of service, resulting in an uninitialized pointer dereference and application crash, via a long URI. **Recommendations** For RealPlayer versions 11.0 through 11.1, update to a version that properly initializes the object component during CDDA URI parsing. For RealPlayer SP versions 1.0 through 1.1.4, update to a version that properly initializes the object component during CDDA URI parsing. For RealPlayer Enterprise version 2.1.2, update to a version that properly initializes the object component during CDDA URI parsing. As a temporary workaround, consider restricting access to the CDDA URI parsing functionality until a patch is available.

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Visual Studio .NET versions 2002 SP1 and 2003 SP1 Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2 Office Project versions 2003 SP3 and 2007 Gold and SP1 Description: A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted AVI file. This triggers an allocation error and memory corruption. The vulnerability can be exploited by constructing a specially crafted web page, potentially leading to remote code execution when viewed. If successfully exploited, an attacker could gain the same user rights as the logged-on user. Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for this issue. For Visual Studio .NET versions 2002 SP1 and 2003 SP1, apply the necessary patch or update to a newer version. For Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2, consider disabling the use of AVI files until a patch is available. For Office Project versions 2003 SP3 and 2007 Gold and SP1, restrict access to crafted web pages to minimize the risk of exploitation.