CVSS: 9.3EPSS: 2%CPEs: 43EXPL: 0CVE-2009-0001
https://notcve.org/view.php?id=CVE-2009-0001
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted RTSP URL. Desbordamiento de búfer basado en montículo en Apple QuickTime anterior a v7.6 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) y posiblemente ejecutar código de su elección a través de una URL RTSP manipulada. • http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.html http://secunia.com/advisories/33632 http://support.apple.com/kb/HT3403 http://www.securityfocus.com/bid/33385 http://www.us-cert.gov/cas/techalerts/TA09-022A.html http://www.vupen.com/english/advisories/2009/0212 https://exchange.xforce.ibmcloud.com/vulnerabilities/48154 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6135 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 4%CPEs: 43EXPL: 0CVE-2009-0004
https://notcve.org/view.php?id=CVE-2009-0004
Buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted MP3 audio file. Desbordamiento de búfer en Apple QuickTime anterior a v7.6 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) y posiblemente ejecutar código de su elección a través de un fichero de audio MP3 manipulado. • http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.html http://secunia.com/advisories/33632 http://support.apple.com/kb/HT3403 http://www.us-cert.gov/cas/techalerts/TA09-022A.html http://www.vupen.com/english/advisories/2009/0212 https://exchange.xforce.ibmcloud.com/vulnerabilities/48157 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6211 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 3%CPEs: 43EXPL: 0CVE-2009-0005
https://notcve.org/view.php?id=CVE-2009-0005
Unspecified vulnerability in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted H.263 encoded movie file that triggers memory corruption. Vulnerabilidad no especificada en QuickTime de Apple antes de v7.6 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) y posiblemente ejecutar código de su elección mediante un archivo de vídeo con codificación H.263 manipulado que dispara una corrupción de memoria. • http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.html http://secunia.com/advisories/33632 http://support.apple.com/kb/HT3403 http://www.securityfocus.com/bid/33386 http://www.us-cert.gov/cas/techalerts/TA09-022A.html http://www.vupen.com/english/advisories/2009/0212 https://exchange.xforce.ibmcloud.com/vulnerabilities/48158 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6187 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 90%CPEs: 43EXPL: 0CVE-2009-0002 – Apple QuickTime VR Track Header Atom Heap Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2009-0002
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a QTVR movie file with crafted THKD atoms. Desbordamiento de búfer basado en montículo en QuickTime de Apple antes de v7.6 permite a atacantes remotos provocar una denegación de servicio (cierre de la aplicación)y posiblemente ejecutar código de su elección mediante un archivo de vídeo QTVR con átomos THKD manipulados. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple Quicktime Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 'tkhd' atoms found inside QuickTimeVR files. Improper validation of the transform matrix data results in a heap chunk header overwrite leading to arbitrary code execution under the context of the currently logged in user. • http://archives.neohapsis.com/archives/bugtraq/2009-01/0210.html http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.html http://osvdb.org/51525 http://secunia.com/advisories/33632 http://support.apple.com/kb/HT3403 http://www.securityfocus.com/bid/33384 http://www.us-cert.gov/cas/techalerts/TA09-022A.html http://www.vupen.com/english/advisories/2009/0212 http://www.zerodayinitiative.com/advisories/ZDI-09-005 https://oval.cisecurity.org/repository/search/d • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 45%CPEs: 42EXPL: 0CVE-2009-0003 – Apple QuickTime AVI Header nBlockAlign Heap Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2009-0003
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via an AVI movie file with an invalid nBlockAlign value in the _WAVEFORMATEX structure. Un desbordamiento de búfer en la región heap de la memoria en Apple QuickTime anterior a la versión 7.6 permite a los atacantes remotos causar una denegación de servicio (terminación de aplicación) y ejecutar código arbitrario por medio de un archivo de película AVI con un valor nBlockAlign no válido en la estructura _WAVEFORMATEX. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AVI files. When the AVI header contains a malformed nBlockAlign value in the _WAVEFORMATEX structure, a heap overflow may occur which can be leveraged to execute arbitrary code under the context of the current user. • http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.html http://osvdb.org/51526 http://secunia.com/advisories/33632 http://support.apple.com/kb/HT3403 http://www.securityfocus.com/bid/33387 http://www.us-cert.gov/cas/techalerts/TA09-022A.html http://www.vupen.com/english/advisories/2009/0212 http://www.zerodayinitiative.com/advisories/ZDI-09-006 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6218 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •