:: Deepquest ::

Zero Day Initiative Advisory 12-107 – This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime.

Zero Day Initiative Advisory 12-105 – This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

Security Explorations does not agree with Apple’s evaluation of a vulnerability they reported. They have decided to release proof of concept code to demonstrate a bypass vulnerability in Apple QuickTime Java extensions.

Zero Day Initiative Advisory 12-095 – This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Quicktime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XML elements within a TeXML file.

Apple Security Advisory 2012-06-12-1 – Multiple vulnerabilities exist in Java, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user

Secunia Security Advisory – Apple has issued an update for Java for Mac OS X.

Secunia Security Advisory – Apple has reported two vulnerabilities in Apple iTunes, which can be exploited by malicious people to compromise a user’s system.

Apple Security Advisory 2012-06-11-1 – iTunes 10.6.3 is now available and addresses multiple issues. Importing a maliciously crafted .m3u playlist may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow existed in the handling of .m3u playlists. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in WebKit.

Apple iTunes version 10.6.1.7 M3U playlist file walking heap buffer overflow proof of concept exploit. This also affects 10.6.0.40.

Proof of concept crash exploit for Safari on iOS that leverage a denial of service vulnerability.