CVSS: 9.3EPSS: 6%CPEs: 12EXPL: 0CVE-2007-2396
https://notcve.org/view.php?id=CVE-2007-2396
The JDirect support in QuickTime for Java in Apple Quicktime before 7.2 exposes certain dangerous interfaces, which allows remote attackers to execute arbitrary code via crafted Java applets. El soporte JDirect de QuickTime para Java en Apple Quicktime anterior a 7.2 expone determinadas interfaces peligrosas, lo cual permite a atacantes remotos ejecutar código de su elección mediante applets Java manipulados. • http://docs.info.apple.com/article.html?artnum=305947 http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html http://osvdb.org/36133 http://secunia.com/advisories/26034 http://www.securityfocus.com/bid/24873 http://www.securitytracker.com/id?1018373 http://www.us-cert.gov/cas/techalerts/TA07-193A.html http://www.vupen.com/english/advisories/2007/2510 https://exchange.xforce.ibmcloud.com/vulnerabilities/35360 •
CVSS: 9.3EPSS: 71%CPEs: 14EXPL: 2CVE-2007-2394 – Apple QuickTime < 7.2 - SMIL Remote Integer Overflow
https://notcve.org/view.php?id=CVE-2007-2394
Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file, related to improper calculations for memory allocation. Desbordamiento de entero en Apple Quicktime anterior a 7.2 en Mac OS X 10.3.9 y 10.4.9 permite a atacantes remotos con la complicidad del usuario ejecutar código de su elección mediante los campos (1) title y (2) author modificados artesanalmente en un fichero SMIL, relacionado con cálculos indebidos para reserva de memoria. • https://www.exploit-db.com/exploits/4359 https://www.exploit-db.com/exploits/30292 http://docs.info.apple.com/article.html?artnum=305947 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=556 http://lists.apple.com/archives/Security-announce/2007/Jul/msg00001.html http://osvdb.org/36134 http://secunia.com/advisories/26034 http://www.securityfocus.com/archive/1/473882/100/100/threaded http://www.securityfocus.com/bid/24873 http://www.securitytracker.com/id?1 •
CVSS: 7.1EPSS: 1%CPEs: 43EXPL: 0CVE-2007-2389
https://notcve.org/view.php?id=CVE-2007-2389
Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not clear potentially sensitive memory before use, which allows remote attackers to read memory from a web browser via unknown vectors related to Java applets. Apple QuickTime para Java 7.1.6 en Mac OS X y Windows no limpia zonas de memoria potencialmente sensibles antes de usarla, lo cual permite a atacantes remotos leer la memoria desde un navegador web a través de vectores desconocidos relacionados con applets Java. • http://lists.apple.com/archives/security-announce/2007/May/msg00005.html http://secunia.com/advisories/25130 http://www.kb.cert.org/vuls/id/434748 http://www.osvdb.org/35575 http://www.securityfocus.com/bid/24222 http://www.securitytracker.com/id?1018136 http://www.vupen.com/english/advisories/2007/1974 https://exchange.xforce.ibmcloud.com/vulnerabilities/34571 •
CVSS: 9.3EPSS: 2%CPEs: 43EXPL: 0CVE-2007-2388
https://notcve.org/view.php?id=CVE-2007-2388
Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations. Apple QuickTime para Java versión 7.1.6 en Mac OS X y Windows, no restringe apropiadamente la subclase de QTObject, lo que permite a atacantes remotos ejecutar código arbitrario por medio de una página web que contiene una clase definida por el usuario que accede a funciones no seguras que pueden ser aprovechadas para escribir en ubicaciones de memoria arbitrarias. • http://lists.apple.com/archives/security-announce/2007/May/msg00005.html http://secunia.com/advisories/25130 http://secunia.com/secunia_research/2007-52/advisory http://www.kb.cert.org/vuls/id/995836 http://www.osvdb.org/35576 http://www.securityfocus.com/bid/24221 http://www.securitytracker.com/id?1018136 http://www.vupen.com/english/advisories/2007/1974 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 10%CPEs: 1EXPL: 0CVE-2007-0754
https://notcve.org/view.php?id=CVE-2007-0754
Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted Sample Table Sample Descriptor (STSD) atom size in a QuickTime movie. Desbordamiento de búfer basado en pila en Apple QuickTime anterior a 7.1.3 permite a atacantes con la intervención del usuario ejecutar código de su elección a través de un tamaño atom Sample Table Sample Descriptor (STSD) manipulado en una película QuickTime. • http://docs.info.apple.com/article.html?artnum=304357 http://dvlabs.tippingpoint.com/advisory/TPTI-07-07 http://securityreason.com/securityalert/2703 http://www.osvdb.org/35574 http://www.securityfocus.com/archive/1/468305/100/0/threaded http://www.securityfocus.com/bid/23923 https://exchange.xforce.ibmcloud.com/vulnerabilities/34244 •