Apple patches QuickTime and iPhoto flaws

Two Apple bugs leave users open to remote code execution

Apple has issued updates for QuickTime and iPhoto affecting Mac OS X, Windows Vista and Windows XP users.

The QuickTime vulnerability leaves users open to attack via a web page embedded with a specially-crafted streaming media file.

The malformed file targets a flaw in the multimedia tool's Remote Transfer Streaming Protocol (RTSP) component.

An attacker could cause QuickTime to crash and remotely execute code on the target system. The flaw was reported on 11 January by security researcher Luigi Auriemma.

This is not the first time Apple has had to patch a vulnerability in QuickTime's RTSP code. Another flaw led to a series of attacks in December.

Apple has also issued an update for iPhoto, the image organising and sharing application which is a standard component of the iLife suite for OS X.

The flaw could allow an attacker to create a malformed Photocast stream which would allow remote code execution on the system of all users who attempted to subscribe. Discovery of the vulnerability is credited to security researcher Nathan McFeters.

Both security updates can be downloaded through Apple's Software Update utility or from the Apple Downloads site.