U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:apple:quicktime:7.4.5:-:mac:*:*:*:*:*
  • CPE Name Search: true
There are 135 matching records.
Displaying matches 121 through 135.
Vuln ID Summary CVSS Severity
CVE-2008-3635

Stack-based buffer overflow in QuickTimeInternetExtras.qtx in an unspecified third-party Indeo v3.2 (aka IV32) codec for QuickTime, when used with Apple QuickTime before 7.5.5 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 9.3 HIGH
CVE-2008-3629

Apple QuickTime before 7.5.5 allows remote attackers to cause a denial of service (application crash) via a crafted PICT image that triggers an out-of-bounds read.

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2008-3628

Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image, related to an "invalid pointer issue."

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 9.3 HIGH
CVE-2008-3627

Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 9.3 HIGH
CVE-2008-3626

The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample_size_table in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file.

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2008-3625

Stack-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a QuickTime Virtual Reality (QTVR) movie file with crafted (1) maxTilt, (2) minFieldOfView, and (3) maxFieldOfView elements in panorama track PDAT atoms.

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 9.3 HIGH
CVE-2008-3624

Heap-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a QuickTime Virtual Reality (QTVR) movie file with crafted panorama atoms.

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2008-3615

ir50_32.qtx in an unspecified third-party Indeo v5 codec for QuickTime, when used with Apple QuickTime before 7.5.5 on Windows, accesses uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 9.3 HIGH
CVE-2008-3614

Integer overflow in Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image, which triggers heap corruption.

Published: September 10, 2008; 9:13:09 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2008-1581

Heap-based buffer overflow in Apple QuickTime before 7.5 on Windows allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted packed scanlines in PixData structures in a PICT image.

Published: June 10, 2008; 2:32:00 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2008-1582

Unspecified vulnerability in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AAC-encoded file that triggers memory corruption.

Published: June 10, 2008; 2:32:00 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2008-1583

Heap-based buffer overflow in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PICT image, a different vulnerability than CVE-2008-1581.

Published: June 10, 2008; 2:32:00 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2008-1584

Stack-based buffer overflow in Indeo.qtx in Apple QuickTime before 7.5 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted Indeo video codec content in a movie file.

Published: June 10, 2008; 2:32:00 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2008-1585

Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file: URLs.

Published: June 10, 2008; 2:32:00 PM -0400
V3.x:(not available)
V2.0: 6.8 MEDIUM
CVE-2008-2010

Unspecified vulnerability in Apple QuickTime Player on Windows XP SP2 and Vista SP1 allows remote attackers to execute arbitrary code via a crafted QuickTime media file. NOTE: as of 20080429, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.

Published: April 29, 2008; 8:10:00 PM -0400
V3.x:(not available)
V2.0: 9.3 HIGH