Apple has plugged two holes in its QuickTime media player that could create serious security problems for people tricked into visiting malicious websites. The release, which is available for both Windows and Mac platforms, is Apple's second security patch in less than a week.

The most serious of the two vulnerabilities involves QuickTime's implementation of Java, which could allow for the manipulation of objects outside what should be allowed by the allocated heap.

"By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution," Apple said in this advisory.

Apple gave credit to John McDonald, Paul Griswold, and Tom Cross of IBM Internet Security Systems X-Force and Dyon Balding of Secunia Research for reporting the flaw.

The other vulnerability also resides in the way QuickTime works with Java and could allow a maliciously crafted applet to read a web browser's memory. That could allow an attacker access to potentially sensitive information, Apple said.

If it seems like Apple security team has been working overtime, it's because it has. On Thursday, the maker of the increasingly popular iMac and iBook released its fifth mega patch in as many months. This fixed more than a dozen security vulnerabilities in OS X. Less than three weeks earlier, Apple patched another hole in QuickTime that could also allow a booby-trapped website to execute malicious code on unwitting Mac users.

QuickTime has emerged as one of the more vulnerable Apple packages, with at least four security updates this year. QuickTime's susceptibility is due in part to its ability to run on both Windows and OS X and its wide use (and occasional abuse) on sites such MySpace.

Apple's update is here. ®

Related stories

• Java 6 for OS X 'weeks away' (28 November 2007)
• QuickTime streaming media exploit targets unpatched bug (26 November 2007)
• QuickTime update fixes code-execution holes (6 November 2007)
• Security maven: QuickTime flaw threatens PCs, Macs (12 September 2007)
• Apple unwraps trio of aluminium iMacs (8 August 2007)
• Serious security hole plugged in RealPlayer and HelixPlayer (28 June 2007)
• Apple releases Mac OS X 10.4.10 (21 June 2007)
• Apple TV gets its first critical security patch (20 June 2007)
• Apple patches more than a dozen holes in OS X (25 May 2007)
• Apple patches security hole in QuickTime (2 May 2007)
• MySpace to be co-opted into Month of Bugs (20 March 2007)
• MySpace-hosted malware exploits QuickTime flaw (16 March 2007)
• Month of Apple Bugs scheme yields first fixes (5 January 2007)
• Unpatched bug bites QuickTime (3 January 2007)
• In Brief Phishing worm hooks MySpace users (5 December 2006)
• Security bugs take a bite out of Apple (7 December 2004)