CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple » Quicktime : Security Vulnerabilities Published In 2007 (Execute Code)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-6238 Exec Code 2007-12-04 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Apple QuickTime 7.2 on Windows XP allows remote attackers to execute arbitrary code via unknown attack vectors, probably a different vulnerability than CVE-2007-6166. NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release advisories with actionable information. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine. However, the organization has stated that this is different than CVE-2007-6166.
2 CVE-2007-6166 119 2 Exec Code Overflow 2007-11-28 2011-08-04
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.
3 CVE-2007-5045 94 Exec Code 2007-09-23 2009-03-04
9.3
 None Remote Medium Not required Complete Complete Complete
Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox "-chrome" argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.
4 CVE-2007-4707 119 Exec Code Overflow 2007-12-14 2008-09-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
Multiple unspecified vulnerabilities in the Flash media handler in Apple QuickTime before 7.3.1 allow remote attackers to execute arbitrary code or have other unspecified impacts via a crafted QuickTime movie.
5 CVE-2007-4706 119 Exec Code Overflow 2007-12-14 2008-11-15
6.8
 None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in Apple QuickTime before 7.3.1 allows remote attackers to execute arbitrary code via a crafted QTL file.
6 CVE-2007-4677 119 Exec Code Overflow 2007-11-07 2008-09-05
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid color table size when parsing the color table atom (CTAB) in a movie file, related to the CTAB RGB values.
7 CVE-2007-4676 119 Exec Code Overflow 2007-11-07 2008-11-15
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing (1) Poly type (0x0070 through 0x0074) and (2) PackBitsRgn field (0x0099) opcodes in a PICT image.
8 CVE-2007-4675 119 Exec Code Overflow 2007-11-07 2011-10-17
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in the QuickTime VR extension 7.2.0.240 in QuickTime.qts in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a QTVR (QuickTime Virtual Reality) movie file containing a large size field in the atom header of a panorama sample atom.
9 CVE-2007-4674 189 Exec Code Overflow 2007-11-27 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
An "integer arithmetic" error in Apple QuickTime 7.2 allows remote attackers to execute arbitrary code via a crafted movie file containing a movie atom with a large size value, which triggers a stack-based buffer overflow.
10 CVE-2007-4673 78 Exec Code 2007-10-04 2008-11-15
9.3
 None Remote Medium Not required Complete Complete Complete
Argument injection vulnerability in Apple QuickTime 7.2 for Windows XP SP2 and Vista allows remote attackers to execute arbitrary commands via a URL in the qtnext field in a crafted QTL file. NOTE: this issue may be related to CVE-2006-4965 or CVE-2007-5045.
11 CVE-2007-4672 119 Exec Code Overflow 2007-11-07 2008-11-15
7.6
 Admin Remote High Not required Complete Complete Complete
Stack-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid UncompressedQuickTimeData opcode length in a PICT image.
12 CVE-2007-3751 Exec Code +Priv 2007-11-07 2008-11-15
9.3
 None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in QuickTime for Java in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via untrusted Java applets that gain privileges via unspecified vectors.
13 CVE-2007-3750 119 Exec Code Overflow 2007-11-07 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via crafted Sample Table Sample Descriptor (STSD) atoms in a movie file.
14 CVE-2007-2397 Exec Code 2007-07-15 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
QuickTime for Java in Apple Quicktime before 7.2 does not properly check permissions, which allows remote attackers to disable security controls and execute arbitrary code via crafted Java applets.
15 CVE-2007-2396 Exec Code 2007-07-15 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
The JDirect support in QuickTime for Java in Apple Quicktime before 7.2 exposes certain dangerous interfaces, which allows remote attackers to execute arbitrary code via crafted Java applets.
16 CVE-2007-2395 Exec Code Mem. Corr. 2007-11-07 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via a crafted image description atom in a movie file, related to "memory corruption."
17 CVE-2007-2394 Exec Code Overflow 2007-07-15 2012-10-30
9.3
 Admin Remote Medium Not required Complete Complete Complete
Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file, related to improper calculations for memory allocation.
18 CVE-2007-2393 Exec Code Bypass 2007-07-15 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
The design of QuickTime for Java in Apple Quicktime before 7.2 allows remote attackers to bypass certain security controls and write to process memory via Java applets, possibly leading to arbitrary code execution.
19 CVE-2007-2392 Exec Code Mem. Corr. 2007-07-15 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via a crafted movie file that triggers memory corruption.
20 CVE-2007-2388 264 Exec Code 2007-05-29 2011-05-18
9.3
 Admin Remote Medium Not required Complete Complete Complete
Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations.
21 CVE-2007-2296 189 Exec Code Overflow 2007-04-26 2011-10-11
9.3
 Admin Remote Medium Not required Complete Complete Complete
Integer overflow in the FlipFileTypeAtom_BtoN function in Apple Quicktime 7.1.5, and other versions before 7.2, allows remote attackers to execute arbitrary code via a crafted M4V (MP4) file.
22 CVE-2007-2295 119 Exec Code Overflow 2007-04-26 2011-10-17
9.3
 Admin Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in the JVTCompEncodeFrame function in Apple Quicktime 7.1.5 and other versions before 7.2 allows remote attackers to execute arbitrary code via a crafted H.264 MOV file.
23 CVE-2007-0754 Exec Code Overflow 2007-05-14 2008-09-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted Sample Table Sample Descriptor (STSD) atom size in a QuickTime movie.
24 CVE-2007-0718 119 DoS Exec Code Overflow Mem. Corr. 2007-03-05 2011-10-18
5.8
 None Remote Medium Not required None Partial Partial
Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a QTIF file with a Video Sample Description containing a Color table ID of 0, which triggers memory corruption when QuickTime assumes that a color table exists.
25 CVE-2007-0717 DoS Exec Code Overflow 2007-03-05 2008-11-13
5.8
 None Remote Medium Not required None Partial Partial
Integer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QTIF file.
26 CVE-2007-0716 DoS Exec Code Overflow 2007-03-05 2008-11-13
5.8
 None Remote Medium Not required None Partial Partial
Stack-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QTIF file.
27 CVE-2007-0715 DoS Exec Code Overflow 2007-03-05 2008-11-13
5.8
 None Remote Medium Not required None Partial Partial
Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PICT file.
28 CVE-2007-0714 189 DoS Exec Code Overflow 2007-03-05 2009-03-16
9.3
 None Remote Medium Not required Complete Complete Complete
Integer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QuickTime movie with a User Data Atom (UDTA) with an Atom size field with a large value.
29 CVE-2007-0713 DoS Exec Code Overflow 2007-03-05 2008-09-05
5.8
 None Remote Medium Not required None Partial Partial
Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QuickTime movie file.
30 CVE-2007-0712 119 DoS Exec Code Overflow 2007-03-05 2009-03-16
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MIDI file.
31 CVE-2007-0711 189 DoS Exec Code Overflow 2007-03-05 2009-03-16
9.3
 None Remote Medium Not required Complete Complete Complete
Integer overflow in Apple QuickTime before 7.1.5, when installed on Windows operating systems, allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP video file.
32 CVE-2007-0588 DoS Exec Code Mem. Corr. 2007-01-30 2008-09-05
7.1
 None Remote Medium Not required None None Complete
The InternalUnpackBits function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT file that triggers memory corruption in the _GetSrcBits32ARGB function. NOTE: this issue might overlap CVE-2007-0462.
33 CVE-2007-0462 DoS Exec Code Mem. Corr. 2007-01-25 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
The _GetSrcBits32ARGB function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT image with a malformed Alpha RGB (ARGB) record, which triggers memory corruption.
34 CVE-2007-0059 Exec Code 2007-01-04 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.
35 CVE-2007-0015 Exec Code Overflow 2007-01-01 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.
Total number of vulnerabilities : 35   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.