CVSS: 9.3EPSS: 93%CPEs: 90EXPL: 0CVE-2009-0954 – Apple Quicktime FIRE Codec Heap Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2009-0954
Heap-based buffer overflow in Apple QuickTime before 7.6.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a movie file containing crafted Clipping Region (CRGN) atom types. Desbordamiento de búfer basado en memoria dinámica en Apple QuickTime anterior a v7.6.2 en Windows permite a atacantes remotos ejecutar código arbitrario o producir una denegación de servicio (caída de aplicación) a través de un fichero de película que contenga una tipos de regiones de clipping manipuladas (CRNG) This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists when the application decodes a .MOV file containing a frame encoded with Quicktime's FIRE codec. While decoding the frame's contents, the application will trust the frame data contains a special terminator during copying of file data to a heap buffer. If the terminator is not found, the application will copy indefinitely. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00000.html http://osvdb.org/54875 http://secunia.com/advisories/35091 http://support.apple.com/kb/HT3591 http://www.securityfocus.com/bid/35167 http://www.securitytracker.com/id?1022314 http://www.vupen.com/english/advisories/2009/1469 https://exchange.xforce.ibmcloud.com/vulnerabilities/50892 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15344 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 20%CPEs: 127EXPL: 1CVE-2009-0951 – Apple Quicktime Picture Viewer FLC Delta-Encoded Frame Decompression Vulnerability
https://notcve.org/view.php?id=CVE-2009-0951
Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLC compression file. Desbordamiento de búfer basado en memoria dinámica (heap) en Apple QuickTime anterior a v7.6.2, permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (caída de aplicación) a través de un archivo de compresión FLC manipulado. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of QuickTime Player. User interaction is required to exploit this vulnerability in that the target must either open a malicious file, or visit a malicious web page. The specific flaw exists during decompression of a delta-encoded chunk. The algorithm to decompress the frame trusts a line specifier when calculating where to write decompressed data. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00000.html http://osvdb.org/54878 http://secunia.com/advisories/35091 http://support.apple.com/kb/HT3591 http://www.securityfocus.com/bid/35161 http://www.securitytracker.com/id?1022314 http://www.vupen.com/english/advisories/2009/1469 https://exchange.xforce.ibmcloud.com/vulnerabilities/50887 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16098 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 59%CPEs: 127EXPL: 0CVE-2009-0953 – Apple Quicktime PICT Opcode 0x8201 Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2009-0953
Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image. Desbordamiento de búfer basado en memoria dinámica (heap) en Apple QuickTime anterior a v7.6.2, permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (caída de aplicación) a través de una imagen PICT manipulada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists in the parsing of PICT files in QuickTime.qts. While processing data for opcode 0x8201 QuickTime trusts a value contained in the file and makes an allocation accordingly. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00000.html http://osvdb.org/54876 http://secunia.com/advisories/35091 http://support.apple.com/kb/HT3591 http://www.securityfocus.com/bid/35164 http://www.securitytracker.com/id?1022314 http://www.vupen.com/english/advisories/2009/1469 https://exchange.xforce.ibmcloud.com/vulnerabilities/50890 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15939 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 2%CPEs: 43EXPL: 0CVE-2009-0001
https://notcve.org/view.php?id=CVE-2009-0001
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted RTSP URL. Desbordamiento de búfer basado en montículo en Apple QuickTime anterior a v7.6 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) y posiblemente ejecutar código de su elección a través de una URL RTSP manipulada. • http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.html http://secunia.com/advisories/33632 http://support.apple.com/kb/HT3403 http://www.securityfocus.com/bid/33385 http://www.us-cert.gov/cas/techalerts/TA09-022A.html http://www.vupen.com/english/advisories/2009/0212 https://exchange.xforce.ibmcloud.com/vulnerabilities/48154 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6135 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 3%CPEs: 43EXPL: 0CVE-2009-0005
https://notcve.org/view.php?id=CVE-2009-0005
Unspecified vulnerability in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted H.263 encoded movie file that triggers memory corruption. Vulnerabilidad no especificada en QuickTime de Apple antes de v7.6 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) y posiblemente ejecutar código de su elección mediante un archivo de vídeo con codificación H.263 manipulado que dispara una corrupción de memoria. • http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.html http://secunia.com/advisories/33632 http://support.apple.com/kb/HT3403 http://www.securityfocus.com/bid/33386 http://www.us-cert.gov/cas/techalerts/TA09-022A.html http://www.vupen.com/english/advisories/2009/0212 https://exchange.xforce.ibmcloud.com/vulnerabilities/48158 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6187 • CWE-399: Resource Management Errors •