CVE-2006-4384

Apple QuickTime < 7.1.3 - Remote Code Execution via FLIC COLOR_64 Chunk

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4384. PoCs published by Sowhat.

AI-analyzed exploit summary The provided text is a vulnerability description for CVE-2006-4384, detailing multiple vulnerabilities in Apple QuickTime due to improper bounds-checking and sanitization of user-supplied data. It references a binary exploit but does not contain actual exploit code.

Description

Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via the COLOR_64 chunk in a FLIC (FLC) movie.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Sowhat · textdososx
https://www.exploit-db.com/exploits/28521

The provided text is a vulnerability description for CVE-2006-4384, detailing multiple vulnerabilities in Apple QuickTime due to improper bounds-checking and sanitization of user-supplied data. It references a binary exploit but does not contain actual exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Apple QuickTime (versions affected in 2006)
No auth needed
Prerequisites: Victim interaction required to open malicious QuickTime file
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (17)

Core 17
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/445888/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016830
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21893
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/28771
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/446134/100/0/threaded
Exploit, Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/19976
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200803-08.xml
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1554
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/28930
Vendor Advisory x_refsource_confirm
http://docs.info.apple.com/article.html?artnum=304357
Patch, Vendor Advisory third-party-advisory x_refsource_idefense
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=413
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3577
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29182
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/489836

Scores

EPSS 0.1525
EPSS Percentile 96.3%

Details

Status published
Products (15)
apple/quicktime 5.0
apple/quicktime 5.0.1
apple/quicktime 5.0.2
apple/quicktime 6.0
apple/quicktime 6.1
apple/quicktime 6.5
apple/quicktime 6.5.1
apple/quicktime 6.5.2 (3 CPE variants)
apple/quicktime 7.0 (2 CPE variants)
apple/quicktime 7.0.1 (4 CPE variants)
... and 5 more
Published Sep 12, 2006
Tracked Since Feb 18, 2026