Vulnerabilities within QuickTime?

[Sunnz]

fryke, I see what you mean, now the fixes are already here a 10.4.9 shouldn't too hard.

On the other hand, the paranoid can patch their system (apps?) from Fuller as the bugs gets released.

Lurk, exactly, with word, they can probably go on and fill up the rest of 2007!!

[fryke]

10.4.9 is already in development, and I think new fixes won't make it into that build. A separate security update release would fit better.

[Captain Code]

Landon's fixes don't really fix anything, they just bypass the problem. It requires you use a program called Application Enhancer which allows his code to be injected into a running application like Quicktime. This code replaces the calls to the vulnerable functions with his own, does some validation to fix the flaw, and then calls the original function.

Not that this isn't a work around for the flaws, but it's not exactly a fix for Apple's code.

[Viro]

While it isn't a fix per se, it's much better than leaving your machine unpatched after the entire world has been alerted to the vulnerabilities affecting Apple machines. I suggest using Landon's fixes until Apple releases an official fix. Waiting till the end of the month before doing something about it doesn't sound safe to me