Vulnerabilidad en Apple QuickTime (CVE-2007-0714)
Gravedad CVSS v2.0:
ALTA
Tipo:
CWE-189
Errores numéricos
Fecha de publicación:
05/03/2007
Última modificación:
09/04/2025
Descripción
Un desbordamiento de enteros en Apple QuickTime anterior a la versión 7.1.5 permite a atacantes remotos asistidos por el usuario causar una denegación de servicio (bloqueo) y posiblemente ejecutar código arbitrario por medio de una película QuickTime creada con un User Data Atom (UDTA) con un campo Atom size con un valor largo.
Impacto
Puntuación base 2.0
9.30
Gravedad 2.0
ALTA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:apple:quicktime:*:-:windows:*:*:*:*:* | 7.1.4 (incluyendo) | |
| cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:4.1.2:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:5.0.1:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:5.0.2:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.0:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.0.0:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.0.1:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.0.2:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.1.0:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.1.1:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.2.0:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.3.0:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.4.0:-:windows:*:*:*:*:* | ||
| cpe:2.3:a:apple:quicktime:6.5.0:-:windows:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0003.html
- http://docs.info.apple.com/article.html?artnum=305149
- http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
- http://osvdb.org/33902
- http://secunia.com/advisories/24359
- http://secway.org/advisory/AD20070306.txt
- http://www.kb.cert.org/vuls/id/861817
- http://www.securityfocus.com/archive/1/461999/100/0/threaded
- http://www.securityfocus.com/archive/1/462153/100/0/threaded
- http://www.securityfocus.com/bid/22827
- http://www.securityfocus.com/bid/22844
- http://www.securitytracker.com/id?1017725=
- http://www.us-cert.gov/cas/techalerts/TA07-065A.html
- http://www.vupen.com/english/advisories/2007/0825
- http://www.zerodayinitiative.com/advisories/ZDI-07-010.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32819
- http://archives.neohapsis.com/archives/fulldisclosure/2007-03/0003.html
- http://docs.info.apple.com/article.html?artnum=305149
- http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
- http://osvdb.org/33902
- http://secunia.com/advisories/24359
- http://secway.org/advisory/AD20070306.txt
- http://www.kb.cert.org/vuls/id/861817
- http://www.securityfocus.com/archive/1/461999/100/0/threaded
- http://www.securityfocus.com/archive/1/462153/100/0/threaded
- http://www.securityfocus.com/bid/22827
- http://www.securityfocus.com/bid/22844
- http://www.securitytracker.com/id?1017725=
- http://www.us-cert.gov/cas/techalerts/TA07-065A.html
- http://www.vupen.com/english/advisories/2007/0825
- http://www.zerodayinitiative.com/advisories/ZDI-07-010.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32819