PT-2007-2046 · Apple · Apple Quicktime+1

Mike Price + 1 · Publicado 2007-01-30 · Atualizado 2013-08-15 · CVE-2007-0588

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apple Quicktime versions 7.1.3 and earlier

Description The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and possibly execute arbitrary code via a crafted PICT file. This is due to memory corruption in the GetSrcBits32ARGB function triggered by the InternalUnpackBits function in Apple QuickDraw.

Recommendations For Apple Quicktime versions 7.1.3 and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, avoid using the InternalUnpackBits function until a patch is available. Restrict access to crafted PICT files to minimize the risk of triggering memory corruption in the GetSrcBits32ARGB function.

Correção

Identificadores relacionados

CVE-2007-0588

Produtos afetados

Quickdraw

Apple Quicktime

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2007-0588 · Nota de Segurança
• http://vupen.com/english/advisories/2007/0930 · Nota
• http://securityfocus.com/bid/22228 · Nota
• http://osvdb.org/33365 · Nota
• http://kb.cert.org/vuls/id/396820 · Nota
• http://secunia.com/advisories/24479 · Nota
• http://docs.info.apple.com/article.html?artnum=305214 · Nota
• http://us-cert.gov/cas/techalerts/TA07-072A.html · Nota
• http://security-protocols.com/sp-x43-advisory.php · Nota
• http://securitytracker.com/id?1017760 · Nota
• http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html · Aviso do Fabricante