VAR-200705-0153
Vulnerability from variot - Updated: 2025-04-10 23:05Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted Sample Table Sample Descriptor (STSD) atom size in a QuickTime movie. Apple QuickTime is prone to a heap-based buffer-overflow issue because it fails to properly check boundaries on user-supplied data before copying it into an insuficiently sized memory buffer. An attacker may exploit this issue by enticing victims into opening a maliciously crafted 'MOV' QuickTime movie file. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the user running the application. Failed exploit attempts likely result in denial-of-service conditions. Versions of QuickTime 7 prior to 7.1.3 are vulnerable. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. There is a heap overflow vulnerability in QuickTime when parsing malformed STSD elements. If an attacker specifies a malicious element size, a heap overflow may be triggered when parsing a MOV file, resulting in arbitrary instruction execution. TPTI-07-07: Apple QuickTime STSD Parsing Heap Overflow Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-07-07 May 10, 2007
-- CVE ID: CVE-2007-0754
-- Affected Vendor: Apple
-- Affected Products: QuickTime Player 7.x
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability since January 31, 2006 by Digital Vaccine protection filter ID 4109. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of malformed Sample Table Sample Descriptor (STSD) atoms. Specifying a malicious atom size can result in an under allocated heap chunk and subsequently an exploitable heap corruption.
-- Vendor Response: Apple has issued an update to correct this vulnerability. More details can be found at:
http://docs.info.apple.com/article.html?artnum=304357
-- Disclosure Timeline: 2006.06.16 - Vulnerability reported to vendor 2006.01.31 - Digital Vaccine released to TippingPoint customers 2007.05.10 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by Ganesh Devarajan, TippingPoint DVLabs
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200705-0153",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "quicktime",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "quicktime",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.1.3"
},
{
"model": "quicktime",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.1"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0"
},
{
"model": "quicktime player",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1"
}
],
"sources": [
{
"db": "BID",
"id": "23923"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-267"
},
{
"db": "NVD",
"id": "CVE-2007-0754"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apple:quicktime",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ganesh Devarajan",
"sources": [
{
"db": "PACKETSTORM",
"id": "56676"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-267"
}
],
"trust": 0.7
},
"cve": "CVE-2007-0754",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2007-0754",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-24116",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2007-0754",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2007-0754",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200705-267",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-24116",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24116"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-267"
},
{
"db": "NVD",
"id": "CVE-2007-0754"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted Sample Table Sample Descriptor (STSD) atom size in a QuickTime movie. Apple QuickTime is prone to a heap-based buffer-overflow issue because it fails to properly check boundaries on user-supplied data before copying it into an insuficiently sized memory buffer. \nAn attacker may exploit this issue by enticing victims into opening a maliciously crafted \u0027MOV\u0027 QuickTime movie file. \nSuccessfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the user running the application. Failed exploit attempts likely result in denial-of-service conditions. \nVersions of QuickTime 7 prior to 7.1.3 are vulnerable. Apple QuickTime is a popular multimedia player that supports a wide variety of media formats. There is a heap overflow vulnerability in QuickTime when parsing malformed STSD elements. If an attacker specifies a malicious element size, a heap overflow may be triggered when parsing a MOV file, resulting in arbitrary instruction execution. TPTI-07-07: Apple QuickTime STSD Parsing Heap Overflow Vulnerability\nhttp://dvlabs.tippingpoint.com/advisory/TPTI-07-07\nMay 10, 2007\n\n-- CVE ID:\nCVE-2007-0754\n\n-- Affected Vendor:\nApple\n\n-- Affected Products:\nQuickTime Player 7.x\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability since January 31, 2006 by Digital Vaccine protection\nfilter ID 4109. User interaction is\nrequired to exploit this vulnerability in that the target must visit a\nmalicious page or open a malicious file. \n\nThe specific flaw exists within the parsing of malformed Sample Table\nSample Descriptor (STSD) atoms. Specifying a malicious atom size can\nresult in an under allocated heap chunk and subsequently an exploitable\nheap corruption. \n\n-- Vendor Response:\nApple has issued an update to correct this vulnerability. More details\ncan be found at:\n\n http://docs.info.apple.com/article.html?artnum=304357\n\n-- Disclosure Timeline:\n2006.06.16 - Vulnerability reported to vendor\n2006.01.31 - Digital Vaccine released to TippingPoint customers\n2007.05.10 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by Ganesh Devarajan,\nTippingPoint DVLabs",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-0754"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
},
{
"db": "BID",
"id": "23923"
},
{
"db": "VULHUB",
"id": "VHN-24116"
},
{
"db": "PACKETSTORM",
"id": "56676"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-24116",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24116"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-0754",
"trust": 2.9
},
{
"db": "BID",
"id": "23923",
"trust": 2.0
},
{
"db": "SREASON",
"id": "2703",
"trust": 1.7
},
{
"db": "OSVDB",
"id": "35574",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001531",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200705-267",
"trust": 0.7
},
{
"db": "XF",
"id": "34244",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20070511 TPTI-07-07: APPLE QUICKTIME STSD PARSING HEAP OVERFLOW VULNERABILITY",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "56676",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-24116",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24116"
},
{
"db": "BID",
"id": "23923"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
},
{
"db": "PACKETSTORM",
"id": "56676"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-267"
},
{
"db": "NVD",
"id": "CVE-2007-0754"
}
]
},
"id": "VAR-200705-0153",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-24116"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-10T23:05:37.826000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "QuickTime 7.1.3 Update",
"trust": 0.8,
"url": "http://support.apple.com/kb/TA24355?viewlocale=en_US"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-0754"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://docs.info.apple.com/article.html?artnum=304357"
},
{
"trust": 2.1,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-07-07"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/23923"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/35574"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/2703"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/468305/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34244"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-0754"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-0754"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/468305/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/34244"
},
{
"trust": 0.3,
"url": "http://www.apple.com/quicktime/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/quicktime/download/"
},
{
"trust": 0.3,
"url": "/archive/1/468305"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2007-0754"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24116"
},
{
"db": "BID",
"id": "23923"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
},
{
"db": "PACKETSTORM",
"id": "56676"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-267"
},
{
"db": "NVD",
"id": "CVE-2007-0754"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-24116"
},
{
"db": "BID",
"id": "23923"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
},
{
"db": "PACKETSTORM",
"id": "56676"
},
{
"db": "CNNVD",
"id": "CNNVD-200705-267"
},
{
"db": "NVD",
"id": "CVE-2007-0754"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-05-14T00:00:00",
"db": "VULHUB",
"id": "VHN-24116"
},
{
"date": "2007-05-11T00:00:00",
"db": "BID",
"id": "23923"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-001531"
},
{
"date": "2007-05-12T02:32:00",
"db": "PACKETSTORM",
"id": "56676"
},
{
"date": "2007-05-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200705-267"
},
{
"date": "2007-05-14T21:19:00",
"db": "NVD",
"id": "CVE-2007-0754"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-16T00:00:00",
"db": "VULHUB",
"id": "VHN-24116"
},
{
"date": "2008-03-13T04:01:00",
"db": "BID",
"id": "23923"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-001531"
},
{
"date": "2007-05-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200705-267"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2007-0754"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200705-267"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple QuickTime Heap-based buffer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-001531"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200705-267"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…