CVE-2007-2394

Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file, related to improper calculations for memory allocation.

Score

CVSS 2.0 9.3 Critical

Status

Modified - cve@mitre.org

Published

2007-07-15

Last modified

2024-08-07

Affected products

• Quicktime (Apple)

References

• http://docs.info.apple.com/article.html?artnum=305947
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=556
• http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html
• http://osvdb.org/36134
• http://secunia.com/advisories/26034
• http://www.securityfocus.com/archive/1/473882/100/100/threaded
• http://www.securityfocus.com/bid/24873
• http://www.securitytracker.com/id?1018373
• http://www.us-cert.gov/cas/techalerts/TA07-193A.html
• http://www.vupen.com/english/advisories/2007/2510
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35357