CVE-2004-0431
published 2004-07-07CVE-2004-0431: Integer overflow in Apple QuickTime (QuickTime.qts) before 6.5.1 allows attackers to execute arbitrary code via a large "number of entries" field in the…
PriorityP266medium5.1CVSS 2.0
AVNACHAuNCPIPAP
ITWVulnCheck KEV
Exploited in the wild
EPSS
3.24%
86.9th percentile
Integer overflow in Apple QuickTime (QuickTime.qts) before 6.5.1 allows attackers to execute arbitrary code via a large "number of entries" field in the sample-to-chunk table data for a .mov movie file, which leads to a heap-based buffer overflow.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | quicktime | <= 6.5 | — |
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
vulncheck5.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g7hr-jcr3-qr24: Integer overflow in Apple QuickTime (QuickTime
ghsa_unreviewed·2022-04-29
CVE-2004-0431 [MEDIUM] GHSA-g7hr-jcr3-qr24: Integer overflow in Apple QuickTime (QuickTime
Integer overflow in Apple QuickTime (QuickTime.qts) before 6.5.1 allows attackers to execute arbitrary code via a large "number of entries" field in the sample-to-chunk table data for a .mov movie file, which leads to a heap-based buffer overflow.
VulnCheck
Apple quicktime Integer Overflow or Wraparound
vulncheck·2004·CVSS 5.1
CVE-2004-0431 [MEDIUM] Apple quicktime Integer Overflow or Wraparound
Apple quicktime Integer Overflow or Wraparound
Integer overflow in Apple QuickTime (QuickTime.qts) before 6.5.1 allows attackers to execute arbitrary code via a large "number of entries" field in the sample-to-chunk table data for a .mov movie file, which leads to a heap-based buffer overflow.
Affected: Apple quicktime
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.virusbulletin.com/virusbulletin/2010/05/exploit-kit-explosion-part-two-vectors-attack/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.apple.com/mhonarc/security-announce/msg00048.htmlhttp://marc.info/?l=bugtraq&m=108360110618389&w=2http://marc.info/?l=ntbugtraq&m=108356485013237&w=2http://www.kb.cert.org/vuls/id/782958https://exchange.xforce.ibmcloud.com/vulnerabilities/16026http://lists.apple.com/mhonarc/security-announce/msg00048.htmlhttp://marc.info/?l=bugtraq&m=108360110618389&w=2http://marc.info/?l=ntbugtraq&m=108356485013237&w=2http://www.kb.cert.org/vuls/id/782958https://exchange.xforce.ibmcloud.com/vulnerabilities/16026
2004-07-07
Published
Exploited in the wild