Description
Apple QuickTime Player 7.0 on Mac OS X 10.4 allows remote attackers to obtain sensitive information via a .mov file with a Quartz Composer composition (.qtz) file that uses certain patches to read local information, then other patches to send the information to the attacker.
References
- http://docs.info.apple.com/article.html?artnum=301714
- ADV-2005-0531 vdb-entry
- http://remahl.se/david/vuln/018
- 13603 vdb-entry
- 20050511 [DR018] Quartz Composer / QuickTime 7 information leakage mailing-list
- 15307 third-party-advisory
- APPLE-SA-2005-05-31 vendor-advisory
- [quartzcomposer-dev] 20050510 Quartz Quicktime embedded in remote webpages... mailing-list
- 1013961 vdb-entry
- 16376 vdb-entry
- [quartzcomposer-dev] 20050511 Re: Quartz Quicktime embedded in remote webpages... mailing-list