Apple fixes security flaws
Finally, version 1.1.3 of the mobile device software addresses an issue with a cross-site scripting attack, which could lead to the disclosure of sensitive information.
Version 7.4 of QuickTime fixes a bug in both Tiger and Leopard (as well as Windows) where viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. The company said that a memory corruption issue exists in QuickTime's handling of Sorenson 3 video files and that the update addresses the issue by performing additional validation of Sorenson 3 video files. In addition, the update fixed similar flaws in QuickTime's handling of Macintosh Resource records in movie files and in QuickTime's parsing of Image Descriptor (IDSC) atoms. Finally, it addressed a fourth cross-platform QuickTime flaw, which was patched in the current update; it could have caused by a buffer overflow may occur while processing a compressed PICT image.