CVSS: 6.8EPSS: 76%CPEs: 1EXPL: 0CVE-2008-1020 – Apple QuickTime Kodak Encoding Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2008-1020
Heap-based buffer overflow in quickTime.qts in Apple QuickTime before 7.4.5 on Windows allows remote attackers to execute arbitrary code via a crafted PICT image file with Kodak encoding, related to error checking and error messages. Desbordamiento de búfer basado en montículo en quickTime.qts de Apple QuickTime antes de 7.4.5 en Windows permite a atacantes remotos ejecutar código de su elección a través de un archivo de imagen PICT manipulado con codificación Kodak, relacionado con comprobaciones y mensajes de error. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple QuickTime Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the quicktime.qts library responsible for parsing Kodak encoded images. A lack of proper error checking can result in a heap based buffer overflow leading to arbitrary code execution under the context of the currently logged in user. • http://secunia.com/advisories/29650 http://securitytracker.com/id?1019764 http://support.apple.com/kb/HT1241 http://www.securityfocus.com/archive/1/490468/100/0/threaded http://www.securityfocus.com/bid/28583 http://www.us-cert.gov/cas/techalerts/TA08-094A.html http://www.vupen.com/english/advisories/2008/1078 http://www.zerodayinitiative.com/advisories/ZDI-08-017 https://exchange.xforce.ibmcloud.com/vulnerabilities/41610 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 8%CPEs: 1EXPL: 0CVE-2008-1021 – Apple QuickTime Run Length Encoding Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2008-1021
Heap-based buffer overflow in Animation codec content handling in Apple QuickTime before 7.4.5 on Windows allows remote attackers to execute arbitrary code via a crafted movie with run length encoding. Desbordamiento de búfer basado en montículo en el controlador de contenido Animation codec de Apple QuickTime antes de 7.4.5 en Windows permite a atacantes remotos ejecutar código de su elección a través de una película manipulada con codificación de longitud de ejecución. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple QuickTime Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of QuickTime files that utilize the Animation codec. A lack of proper length checks can result in a heap based buffer overflow leading to arbitrary code execution under the context of the currently logged in user. • http://secunia.com/advisories/29650 http://securitytracker.com/id?1019765 http://support.apple.com/kb/HT1241 http://www.securityfocus.com/archive/1/490462/100/0/threaded http://www.securityfocus.com/bid/28583 http://www.us-cert.gov/cas/techalerts/TA08-094A.html http://www.vupen.com/english/advisories/2008/1078 http://www.zerodayinitiative.com/advisories/ZDI-08-018 https://exchange.xforce.ibmcloud.com/vulnerabilities/41612 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 76%CPEs: 1EXPL: 0CVE-2008-1022 – Apple QuickTime Malformed VR obji Atom Parsing Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2008-1022
Stack-based buffer overflow in Apple QuickTime before 7.4.5 allows remote attackers to execute arbitrary code via a crafted VR movie with an obji atom of zero size. Desbordamiento de búfer en Apple QuickTime antes de 7.4.5 permite a atacantes remotos ejecutar código de su elección a través de una película VR manipulada con un átomo obji de tamaño cero. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists in the parsing of the QuickTime VR 'obji' atom. When the size of the atom is set to 0, a stack overflow condition occurs resulting in the execution of arbitrary code. • http://secunia.com/advisories/29650 http://securitytracker.com/id?1019766 http://support.apple.com/kb/HT1241 http://www.securityfocus.com/archive/1/490461/100/0/threaded http://www.securityfocus.com/bid/28583 http://www.us-cert.gov/cas/techalerts/TA08-094A.html http://www.vupen.com/english/advisories/2008/1078 http://www.zerodayinitiative.com/advisories/ZDI-08-019 https://exchange.xforce.ibmcloud.com/vulnerabilities/41613 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 84%CPEs: 1EXPL: 2CVE-2008-0778 – QuickTime 7.4.1 - 'QTPlugin.ocx' Multiple Stack Overflow Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-0778
Multiple stack-based buffer overflows in an ActiveX control in QTPlugin.ocx for Apple QuickTime 7.4.1 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the (1) SetBgColor, (2) SetHREF, (3) SetMovieName, (4) SetTarget, and (5) SetMatrix methods. Múltiples vulnerabilidades de desbordamiento de búfer basado en pila en ActiveX control in QTPlugin.ocx for Apple QuickTime 7.4.1 y anteriores, permite a atacantes remotos causar una denegación de servicio y la posibilidad de ejecutar código de su elección a través de argumentos largos a los métodos: (1) setBgColor, (2) SetHREF, (3) SetMovieNAme, (4) SetTarget, y SetMatrix. • https://www.exploit-db.com/exploits/5110 http://securityreason.com/securityalert/3652 http://www.securityfocus.com/archive/1/488045/100/0/threaded http://www.securityfocus.com/bid/27769 https://exchange.xforce.ibmcloud.com/vulnerabilities/40475 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.8EPSS: 11%CPEs: 1EXPL: 0CVE-2008-0032
https://notcve.org/view.php?id=CVE-2008-0032
Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a movie file containing a Macintosh Resource record with a modified length value in the resource header, which triggers heap corruption. Apple QuickTime before 7.4 permite a atacantes remotos ejecutar código de su elección a través de un archivo de película que contiene un registro Macintosh Resource con valor de longitud modificado en la cabecera del recurso, el cual dispara una corrupción de pila. • http://docs.info.apple.com/article.html?artnum=307301 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=642 http://lists.apple.com/archives/security-announce/2008/Jan/msg00001.html http://secunia.com/advisories/28502 http://www.securityfocus.com/bid/27301 http://www.securitytracker.com/id?1019221 http://www.us-cert.gov/cas/techalerts/TA08-016A.html http://www.vupen.com/english/advisories/2008/0148 https://exchange.xforce.ibmcloud.com/vulnerabilities/39696 • CWE-399: Resource Management Errors •