1. CVE-Search
  2. CVE-2007-2175
ID CVE-2007-2175
Summary Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the "PWN 2 0WN" contest at CanSecWest 2007.
References
Vulnerable Configurations
  • cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
    cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
CVSS
Base: 7.6 (as of 16-10-2018 - 16:42)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:H/Au:N/C:C/I:C/A:C
refmap via4
apple APPLE-SA-2007-05-01
bugtraq 20070501 ZDI-07-023: Apple QTJava toQTPointer() Pointer Arithmetic Memory Overwrite Vulnerability
cert-vn VU#420668
confirm http://docs.info.apple.com/article.html?artnum=305446
misc
osvdb 34178
sectrack 1017950
xf quicktime-unspecified-code-execution(33827)
Last major update 16-10-2018 - 16:42
Published 24-04-2007 - 16:19
Last modified 16-10-2018 - 16:42
Back to Top