1. CVE-Search
  2. CVE-2007-0059
ID CVE-2007-0059
Summary Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.
References
Vulnerable Configurations
  • cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:-:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:-:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:3:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:3:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:4.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:5.0.2:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:5.0.2:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.0:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.0:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.1:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.1:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.1:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.1:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.2:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.2:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.0.2:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.0.2:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.1.0:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.1.0:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.1.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.1.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.1.1:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.1.1:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.1.1:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.1.1:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.2.0:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.2.0:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.2.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.2.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.3.0:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.3.0:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.3.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.3.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.4.0:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.4.0:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.4.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.4.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.0:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.0:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.1:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.1:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.1:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.1:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.2:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.2:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:6.5.2:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:6.5.2:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.0:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.0:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.1:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.1:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.1:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.1:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.2:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.2:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.2:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.2:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.3:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.3:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.3:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.3:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.4:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.4:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.4:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.4:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.0:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.0:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.0:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.0:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.1:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.1:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.1:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.1:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.2:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.2:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.2:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.2:-:windows:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.3:-:mac:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.3:-:mac:*:*:*:*:*
  • cpe:2.3:a:apple:quicktime:7.1.3:-:windows:*:*:*:*:*
    cpe:2.3:a:apple:quicktime:7.1.3:-:windows:*:*:*:*:*
CVSS
Base: 6.8 (as of 30-10-2018 - 16:25)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
refmap via4
apple APPLE-SA-2007-03-05
cert-vn VU#304064
confirm http://docs.info.apple.com/article.html?artnum=305149
misc
osvdb 31164
statements via4
contributor Ron Dumont
lastmodified 2007-03-19
organization Apple
statement This issue is addressed in QuickTime 7.1.5, which was released on March 5. Information on the security fixes provided in QuickTime 7.1.5, and links to obtain the update are provided in: http://docs.info.apple.com/article.html?artnum=305149
Last major update 30-10-2018 - 16:25
Published 05-01-2007 - 00:28
Last modified 30-10-2018 - 16:25
Back to Top