PT-2007-2046 · Apple · Apple Quicktime+1

Mike Price + 1 · Published 2007-01-30 · Updated 2013-08-15 · CVE-2007-0588

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apple Quicktime versions 7.1.3 and earlier

Description The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and possibly execute arbitrary code via a crafted PICT file. This is due to memory corruption in the GetSrcBits32ARGB function triggered by the InternalUnpackBits function in Apple QuickDraw.

Recommendations For Apple Quicktime versions 7.1.3 and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, avoid using the InternalUnpackBits function until a patch is available. Restrict access to crafted PICT files to minimize the risk of triggering memory corruption in the GetSrcBits32ARGB function.

Fix

Related Identifiers

CVE-2007-0588

Affected Products

Quickdraw

Apple Quicktime

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2007-0588 · Security Note
• http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html · Vendor Advisory
• http://vupen.com/english/advisories/2007/0930 · Note
• http://securityfocus.com/bid/22228 · Note
• http://osvdb.org/33365 · Note
• http://kb.cert.org/vuls/id/396820 · Note
• http://secunia.com/advisories/24479 · Note
• http://docs.info.apple.com/article.html?artnum=305214 · Note
• http://us-cert.gov/cas/techalerts/TA07-072A.html · Note
• http://security-protocols.com/sp-x43-advisory.php · Note
• http://securitytracker.com/id?1017760 · Note