Vulnerability Details : CVE-2007-0051
Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.
Vulnerability category: OverflowExecute code
Exploit prediction scoring system (EPSS) score for CVE-2007-0051
Probability of exploitation activity in the next 30 days: 91.66%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-0051
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2007-0051
-
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-0051
-
http://projects.info-pull.com/moab/MOAB-04-01-2007.html
Exploit;Vendor Advisory
-
https://www.exploit-db.com/exploits/3080
-
http://www.securityfocus.com/archive/1/455968/100/0/threaded
-
http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0100.html
-
http://docs.info.apple.com/article.html?artnum=305215
-
http://www.securityfocus.com/bid/21871
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/31281
-
http://www.vupen.com/english/advisories/2007/0057
Vendor Advisory
-
http://lists.apple.com/archives/security-announce/2007/Mar//msg00003.html
Products affected by CVE-2007-0051
- cpe:2.3:a:apple:iphoto:6.0.5:*:*:*:*:*:*:*