Apple has released a patch for a flaw in its QuickTime media player — more than three weeks after the vulnerability was discovered.