CVE-2007-4676

2007-11-0723:46:00

CWE-119

mitre

web.nvd.nist.gov

cve-2007-4676

apple quicktime

buffer overflow

remote code execution

pict image

security vulnerability

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.7

Confidence

Low

EPSS

0.943

Percentile

99.3%

JSON

Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing (1) Poly type (0x0070 through 0x0074) and (2) PackBitsRgn field (0x0099) opcodes in a PICT image.

Affected configurations

Nvd

Node

applequicktimeRange<7.3

AND

applemac_os_xMatch10.3.9

applemac_os_xMatch10.4.10

applemac_os_xMatch10.5

microsoftwindows_vistaMatch-

microsoftwindows_xpMatch-sp2

VendorProductVersionCPE
applequicktime*cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*
applemac_os_x10.3.9cpe:2.3:o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:*
applemac_os_x10.4.10cpe:2.3:o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*
applemac_os_x10.5cpe:2.3:o:apple:mac_os_x:10.5:*:*:*:*:*:*:*
microsoftwindows_vista-cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*
microsoftwindows_xp-cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	quicktime	*	cpe:2.3:a:apple:quicktime::::::::
apple	mac_os_x	10.3.9	cpe:2.3:o:apple:mac_os_x:10.3.9:::::::*
apple	mac_os_x	10.4.10	cpe:2.3:o:apple:mac_os_x:10.4.10:::::::*
apple	mac_os_x	10.5	cpe:2.3:o:apple:mac_os_x:10.5:::::::*
microsoft	windows_vista	-	cpe:2.3:o:microsoft:windows_vista:-:::::::*
microsoft	windows_xp	-	cpe:2.3:o:microsoft:windows_xp:-:sp2::::::