docs.info.apple.comConfirmation
http://docs.info.apple.com/article.html?artnum=305947 CVE-2007-2394
Apple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution Vulnerabilities
Record summary
CVE-2007-2394 has a selected CVSS score of 9.3; EIP currently links 2 catalogued exploits.
Description
Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file, related to improper calculations for memory allocation.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 2
Proofs of concept
2Catalogued exploits
ExploitDBApple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution VulnerabilitiesExploitDB exploitby WolfNot analyzed1 file
ExploitDBApple QuickTime < 7.2 - SMIL Remote Integer OverflowExploitDB exploitby David VaartjesNot analyzed1 file
References
1220070711 Apple QuickTime SMIL File Processing Integer Overflow VulnerabilityThird-party advisory
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=556 APPLE-SA-2007-07-11Vendor advisory
http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html 36134vdb entry
http://osvdb.org/36134 26034Third-party advisory
http://secunia.com/advisories/26034 20070717 Re: iDefense Security Advisory 07.11.07: Apple QuickTime SMIL File Processing Integer Overflow Vulnerabilitymailing list
http://www.securityfocus.com/archive/1/473882/100/100/threaded 24873vdb entry
http://www.securityfocus.com/bid/24873 1018373vdb entry
http://www.securitytracker.com/id?1018373 TA07-193AThird-party advisory
http://www.us-cert.gov/cas/techalerts/TA07-193A.html ADV-2007-2510vdb entry
http://www.vupen.com/english/advisories/2007/2510 quicktime-smil-overflow(35357)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/35357 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2007-2394