リモート Windows ホストにインストールされている QuickTime のバージョンが 7.7.3 より前であるため、報告によれば、以下の脆弱性の影響を受けます：

  - A buffer overflow exists in the handling of REGION records in PICT files. (CVE-2011-1374)

  - A memory corruption issue exists in the handling of PICT files. (CVE-2012-3757)

  - A use-after-free issue exists in the QuickTime plugin's handling of '_qtactivex_' parameters within an HTML object element. (CVE-2012-3751)

  - A buffer overflow exists in the handling of the transform attribute in text3GTrack elements in TeXML files. (CVE-2012-3758)

  - Multiple buffer overflows exist in the handling of style elements in TeXML files. (CVE-2012-3752)

  - MIME タイプの処理に、バッファオーバーフローが存在します。
    (CVE-2012-3753)

  - A use-after-free issue exists in the QuickTime ActiveX control's handling of the 'Clear()' method. (CVE-2012-3754)

  - A buffer overflow exists in the handling of Targa image files. (CVE-2012-3755)

  - A buffer overflow exists in the handling of 'rnet' boxes in MP4 files. (CVE-2012-3756)

これらの問題の悪用が成功すると、プログラムが停止させられたり、ユーザーの権限に属している任意のコードが実行されたりします。

The version of QuickTime installed on the remote Windows host is older than 7.7.3 and therefore is reportedly affected by the following vulnerabilities :

  - A buffer overflow exists in the handling of REGION     records in PICT files. (CVE-2011-1374)

  - A memory corruption issue exists in the handling of     PICT files. (CVE-2012-3757)

  - A use-after-free issue exists in the QuickTime plugin's     handling of '_qtactivex_' parameters within an HTML     object element. (CVE-2012-3751)

  - A buffer overflow exists in the handling of the     transform attribute in text3GTrack elements in TeXML     files. (CVE-2012-3758)

  - Multiple buffer overflows exist in the handling of     style elements in TeXML files. (CVE-2012-3752)

  - A buffer overflow exists in the handling of MIME types.
    (CVE-2012-3753)

  - A use-after-free issue exists in the QuickTime ActiveX     control's handling of the 'Clear()' method.     (CVE-2012-3754)

  - A buffer overflow exists in the handling of Targa image     files. (CVE-2012-3755)

  - A buffer overflow exists in the handling of 'rnet'     boxes in MP4 files. (CVE-2012-3756)

Successful exploitation of these issues could result in program termination or arbitrary code execution, subject to the user's privileges.

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.3. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - CoreTypes
  - International Components for Unicode
  - Identity Services
  - ImageIO
  - IOAcceleratorFamily
  - Kernel
  - Login Window
  - Messages
  - PDFKit
  - QuickTime
  - Security

Note that the update also runs a malware removal tool that will remove the most common variants of malware.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-001 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - CoreTypes (10.7 only)
  - International Components for Unicode
  - Identity Services (10.7 only)
  - ImageIO
  - Messages Server (Server only)
  - PDFKit
  - Podcast Producer Server (Server only)
  - PostgreSQL (Server only)
  - Profile Manager (10.7 Server only)
  - QuickTime
  - Ruby (10.6 Server only)
  - Security
  - Software Update
  - Wiki Server (10.7 Server only)

Note that the update also runs a malware removal tool that will remove the most common variants of malware.

远程 Windows 主机上安装的 QuickTime 版本低于 7.7.3，因此据报告其受到以下问题的影响：

- 对 PICT 文件中的 REGION 记录的处理中存在一个缓冲区溢出。(CVE-2011-1374)

- 对 PICT 文件的处理中存在一个内存损坏问题。(CVE-2012-3757)

- QuickTime 插件对 HTML object 元素内的“_qtactivex_”参数的处理中存在一个释放后使用问题。(CVE-2012-3751)

- 对 TeXML 文件中 text3GTrack 元素中的 transform 属性的处理中存在一个缓冲区溢出。(CVE-2012-3758)

- 对 TeXML 文件中的 style 元素的处理中存在多种缓冲区溢出。(CVE-2012-3752)

- 对 MIME 类型的处理中存在一个缓冲区溢出。
 (CVE-2012-3753)

- QuickTime ActiveX 控件对“Clear()”方法的处理中存在一个释放后使用问题。(CVE-2012-3754)

- 对 Targa 图像文件的处理中存在一个缓冲区溢出。(CVE-2012-3755)

- 对 MP4 文件中的“rnet”框的处理中存在一个缓冲区溢出。(CVE-2012-3756)

成功利用这些问题可能导致程序终止或执行任意代码，具体受限于用户的权限。

遠端 Windows 主機上安裝的 QuickTime 版本比 7.7.3 舊，因此據報會受到下列弱點影響：

- 處理 PICT 檔案中的 REGION 記錄時存在一個緩衝區溢位。(CVE-2011-1374)

- 處理 PICT 檔案時存在一個記憶體損毀問題。(CVE-2012-3757)

- QuickTime 外掛程式 HTML 處理物件元素中的「_qtactivex_」參數時存在一個釋放後使用問題。(CVE-2012-3751)

- 處理 TeXML 檔案中 text3GTrack 元素的轉換屬性時存在一個緩衝區溢位。(CVE-2012-3758)

- 處理 TeXML 檔案中的樣式元素時存在多個緩衝區溢位。(CVE-2012-3752)

- 處理 MIME 類型時存在一個緩衝區溢位。
 (CVE-2012-3753)

- QuickTime ActiveX 控制項處理「Clear()」方法時存在一個釋放後使用問題。(CVE-2012-3754)

- 處理 Targa 影像檔時存在一個緩衝區溢位。(CVE-2012-3755)

- 處理 MP4 檔案中的「rnet」方塊時存在一個緩衝區溢位。(CVE-2012-3756)

如果成功惡意利用這些問題，可導致程式終止或執行需要使用者權限的任意程式碼。

リモートホストが、バージョン 10.8.3 より前の Mac OS X 10.8.x を実行しています。新しいバージョンには、次のコンポーネントに対する複数のセキュリティ関連の修正が含まれています。

  - Apache
  - CoreTypes
  - International Components for Unicode
  - Identity Services
  - ImageIO
  - IOAcceleratorFamily
  - Kernel
  - Login Window
  - メッセージ
  - PDFKit
  - QuickTime
  - セキュリティ

注意：また、この更新ではマルウェア駆除ツールを実行し、これにより大半の一般的な種類のマルウェアは駆除されます。

リモートホストは、セキュリティ更新 2013-001 が適用されていない Mac OS X 10.6 または 10.7 バージョンを実行しています。この更新は、次のコンポーネントのために考えられた数々のセキュリティ関連の修正を含んでいます。

- Apache
 - CoreTypes（10.7 のみ）
 - International Components for Unicode
 - Identity Services（10.7 のみ）
 - ImageIO
 - Messages Server（Server のみ）
 - PDFKit
 - Podcast Producer Server（Server のみ）
 - PostgreSQL（Server のみ）
 - Profile Manager（10.7 サーバーのみ）
 - QuickTime
 - Ruby（10.6 Server のみ）
 - Security
 - Software Update
 - Wiki Server（10.7 Server のみ）

注意：また、この更新ではマルウェア駆除ツールを実行し、これにより大半の一般的な種類のマルウェアは駆除されます。

遠端主機執行的 Mac OS X 10.8.x 版本比 10.8.3 版舊。此更新版本包含下列元件的多項安全性相關修正：

  - Apache
  - CoreTypes
  - International Components for Unicode
  - Identity Services
  - ImageIO
  - IOAcceleratorFamily
  - Kernel
  - Login Window
  - Messages
  - PDFKit
  - QuickTime
  - Security

請注意，更新亦會執行惡意程式碼移除工具，移除多數常見的惡意程式碼變體。

遠端主機執行的 Mac OS X 10.6 或 10.7 版本並未套用安全性更新 2013-001。此更新包含下列元件的多個安全性相關修正：

- Apache
 - CoreTypes (僅限 10.7 版)
 - International Components for Unicode
 - Identity Services (僅限 10.7 版)
 - ImageIO
 - Messages Server (僅限伺服器)
 - PDFKit
 - Podcast Producer Server (僅限伺服器)
 - PostgreSQL (僅限伺服器)
 - Profile Manager (僅限 10.7 版伺服器)
 - QuickTime
 - Ruby (僅限 10.6 版伺服器)
 - Security
 - Software Update
 - Wiki Server (僅限 10.7 版伺服器)

請注意，更新亦會執行惡意程式碼移除工具，移除多數常見的惡意程式碼變體。

远程主机运行的 Mac OS X 10.8.x 版低于 10.8.3。更新的版本包含针对以下组件的与安全有关的多个补丁：

  - Apache
  - CoreTypes
  - International Components for Unicode
  - Identity Services
  - ImageIO
  - IOAcceleratorFamily
  - 内核
  - Login Window
  - 信息
  - PDFKit
  - QuickTime
  - 安全性

请注意，此更新还运行恶意软件删除工具，用于删除最常见的恶意软件变体。

远程主机正在运行的 Mac OS X 10.6 或 10.7 版本未应用安全更新 2013-001。此更新包含针对以下组件的大量安全相关补丁：

- Apache
 - CoreTypes（仅限 10.7）
 - International Components for Unicode
 - Identity Services（仅限 10.7）
 - ImageIO
 - Messages Server（仅限 Server）
 - PDFKit
 - Podcast Producer Server（仅限 Server）
 - PostgreSQL（仅限 Server）
 - Profile Manager（仅限 10.7 Server）
 - QuickTime
 - Ruby（仅限 10.6 Server）
 - Security
 - Software Update
 - Wiki Server（仅限 10.7 Server）

请注意，此更新还运行恶意软件删除工具，用于删除最常见的恶意软件变体。

Versions of QuickTime earlier thanolder than 7.7.3 are affected by the following vulnerabilities :

  - A buffer overflow exists in the handling of REGION records in PICT files. (CVE-2011-1374)

  - A memory corruption issue exists in the handling of PICT files. (CVE-2012-3757)

  - A use-after-free issue exists in the QuickTime plugin's handling of '_qtactivex_' parameters within an HTML object element. (CVE-2012-3751)

  - A buffer overflow exists in the handling of the transform attribute in text3GTrack elements in TeXML files. (CVE-2012-3758)

  - Multiple buffer overflows exist in the handling of style elements in TeXML files. (CVE-2012-3752)

  - A buffer overflow exists in the handling of MIME types. (CVE-2012-3753)

  - A use-after-free issue exists in the QuickTime ActiveX control's handling of the 'Clear()' method. (CVE-2012-3754)

  - A buffer overflow exists in the handling of Targa image files. (CVE-2012-3755)

  - A buffer overflow exists in the handling of 'rnet' boxes in MP4 files. (CVE-2012-3756)
Successful exploitation of these issues could result in program termination or arbitrary code execution, subject to the user's privileges.

The remote host is running a version of Mac OS X 10.8 that is older than version 10.8.3. The newer version contains numerous security-related fixes :

  - A canonicalization issue existed in the handling of URIs with ignorable Unicode character sequences. This issue was addressed by updating mod_hfs_apple to forbid access to URIs with ignorable Unicode character sequences. (CVE-2013-0966)
  - Java Web Start applications would run even if the Java plug-in was disabled. This issue was addressed by removing JNLP files from the CoreTypes safe file type list, so the Web Start application will not be run unless the user opens it in the Downloads directory. (CVE-2013-0967)
  - A canonicalization issue existed in the handling of the EUC-JP encoding, which could lead to a cross-site scripting attack on EUC-JP encoded websites. This issue was addressed by updating the EUC-JP mapping table. (CVE-2011-3058)
  - An error handling issue existed in Identity Services. If the user's AppleID certificate failed to validate, the user's AppleID was assumed to be the empty string. If multiple systems belonging to different users enter this state, applications relying on this identity determination may erroneously extend trust. This issue was addressed by ensuring that NULL is returned instead of an empty string. (CVE-2013-0963)
  - Description: A buffer overflow existed in libtiff's handling of TIFF images. This issue was addressed through additional validation of TIFF images. (CVE-2012-2088)
  - A memory corruption issue existed in the handling of graphics data. This issue was addressed through improved bounds checking.(CVE-2013-0976)
  - An information disclosure issue existed in the handling of APIs related to kernel extensions. Responses containing an OSBundleMachOHeaders key may have included kernel addresses, which may aid in bypassing address space layout randomization protection. (CVE-2012-3749)
  - A logic error existed in VoiceOver's handling of the Login Window, whereby an attacker with access to the keyboard could launch System Preferences and modify the system configuration. This issue was addressed by preventing VoiceOver from launching applications at the Login Window. (CVE-2013-0969)
  - Clicking on a specifically-formatted FaceTime:// URL in Messages could bypass the standard confirmation prompt. This issue was addressed by additional validation of FaceTime:// URLs. (CVE-2013-0970)
  - An issue existed in the Jabber server's handling of dialback result messages. An attacker may cause the Jabber server to disclose information intended for users of federated servers. This issue was addressed through improved handling of dialback result messages. (CVE-2012-3525)
  - Description: A use after free issue existed in the handling of ink annotations in PDF files. This issue was addressed through improved memory management. (CVE-2013-0971)
  - A type casting issue existed in Ruby on Rails' handling of XML parameters. This issue was addressed by disabling XML parameters in the Rails implementation used by Podcast Producer Server. (CVE-2013-0156)
  - A buffer overflow existed in the handling of 'rnet' boxes in MP4 files. This issue was addressed through improved bounds checking. (CVE-2012-3756)

ID	名稱	產品	系列	已發布	已更新	嚴重性
62890	7.7.3より前のQuickTimeの複数の脆弱性（Windows）	Nessus	Windows	2012/11/12	2019/12/4	high
62890	QuickTime < 7.7.3 Multiple Vulnerabilities (Windows)	Nessus	Windows	2012/11/12	2019/12/4	high
65577	Mac OS X 10.8.x < 10.8.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high
65578	Mac OS X Multiple Vulnerabilities (Security Update 2013-001)	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high
62890	QuickTime < 7.7.3 多种漏洞 (Windows)	Nessus	Windows	2012/11/12	2019/12/4	high
62890	QuickTime < 7.7.3 多個弱點 (Windows)	Nessus	Windows	2012/11/12	2019/12/4	high
65577	Mac OS X 10.8.x < 10.8.3 の複数の脆弱性	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high
65578	Mac OS X 複数の脆弱性（セキュリティ更新 2013-001）	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high
65577	Mac OS X 10.8.x < 10.8.3 多個弱點	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high
65578	Mac OS X 多個弱點 (安全性更新 2013-001)	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high
65577	Mac OS X 10.8.x < 10.8.3 多种漏洞	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high
65578	Mac OS X 多种漏洞（安全更新 2013-001）	Nessus	MacOS X Local Security Checks	2013/3/15	2024/5/28	high
6620	QuickTime < 7.7.3 Multiple Vulnerabilities (Windows)	Nessus Network Monitor	Web Clients	2012/11/16	2019/3/6	high
6717	Mac OS X 10.8 < 10.8.3 Multiple Vulnerabilities (Security Update 2013-001)	Nessus Network Monitor	Web Clients	2013/3/16	2019/3/6	high
801209	QuickTime < 7.7.3 Multiple Vulnerabilities (Windows)	Log Correlation Engine	Web Clients	2012/11/16		high
801018	Mac OS X 10.8 < 10.8.3 Multiple Vulnerabilities (Security Update 2013-001)	Log Correlation Engine	Operating System Detection	2013/3/16		high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high