Apple updated its media workhorse QuickTime to version 7.4 last week, fixing bugs and adding support for new iTunes features such as downloadable movie rentals. But the more important news is that this version squashes a handful of security holes that could allow remote attacks. However, a serious vulnerability discovered shortly before Macworld Expo demonstrates that Apple's engineers need to remain hard at work.

The QuickTime 7.4 update is available for Leopard (a 55 MB download), Tiger (a 51 MB download), Panther (a 50 MB download), and Windows (both XP and Vista, a 22 MB download).

The most recent exploit, not addressed in QuickTime 7.4, takes advantage of a hole in QuickTime's RTSP (Real Time Streaming Protocol) that could open a computer to a denial-of-service attack or possible remote code execution. (RTSP is not a new target; see "Protect Yourself from the QuickTime RTSP Vulnerability," 2007-09-07.) Because QuickTime is the underlying technology of iTunes, Macs and Windows computers running QuickTime are vulnerable. Anyone who uses iTunes or owns an iPod should update.