CVE-2017-9124

Name of the Vulnerable Software and Affected Versions libquicktime version 1.2.4

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a crafted mp4 file. This is due to a problem in the quicktime match 32 function in util.c.

Recommendations For libquicktime version 1.2.4, consider avoiding the use of crafted mp4 files until a patch is available. As a temporary workaround, restricting access to the quicktime match 32 function in util.c may help minimize the risk of exploitation.