ByteOS Network

NVD Vulnerability Details :

CVE-2006-4965

Deferred

Source-cve@mitre.org

Published At-25 Sep, 2006 | 00:07

Updated At-03 Apr, 2025 | 01:03

Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter that identifies resources outside of the original domain. NOTE: as of 20070912, this issue has been demonstrated by using instances of Components.interfaces.nsILocalFile and Components.interfaces.nsIProcess to execute arbitrary local files within Firefox and possibly Internet Explorer.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:N/I:P/A:N

CPE Matches

Apple Inc.

>>quicktime>>7.1.3

cpe:2.3:a:apple:quicktime:7.1.3:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-94	Primary	nvd@nist.gov

CWE ID: CWE-94

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://docs.info.apple.com/article.html?artnum=305149	cve@mitre.org	N/A
http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html	cve@mitre.org	N/A
http://secunia.com/advisories/22048	cve@mitre.org	Exploit Vendor Advisory
http://secunia.com/advisories/27414	cve@mitre.org	Vendor Advisory
http://securityreason.com/securityalert/1631	cve@mitre.org	N/A
http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox	cve@mitre.org	N/A
http://www.gnucitizen.org/blog/backdooring-mp3-files/	cve@mitre.org	Exploit
http://www.gnucitizen.org/blog/myspace-quicktime-worm-follow-up	cve@mitre.org	N/A
http://www.kb.cert.org/vuls/id/751808	cve@mitre.org	US Government Resource
http://www.securityfocus.com/archive/1/446750/100/0/threaded	cve@mitre.org	N/A
http://www.securityfocus.com/archive/1/453756/100/0/threaded	cve@mitre.org	N/A
http://www.securityfocus.com/archive/1/479179/100/0/threaded	cve@mitre.org	N/A
http://www.securityfocus.com/bid/20138	cve@mitre.org	Exploit
http://www.securitytracker.com/id?1018687	cve@mitre.org	N/A
http://www.vupen.com/english/advisories/2007/3155	cve@mitre.org	N/A
http://docs.info.apple.com/article.html?artnum=305149	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/22048	af854a3a-2127-422b-91ae-364da2661108	Exploit Vendor Advisory
http://secunia.com/advisories/27414	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://securityreason.com/securityalert/1631	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.gnucitizen.org/blog/backdooring-mp3-files/	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://www.gnucitizen.org/blog/myspace-quicktime-worm-follow-up	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.kb.cert.org/vuls/id/751808	af854a3a-2127-422b-91ae-364da2661108	US Government Resource
http://www.securityfocus.com/archive/1/446750/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/archive/1/453756/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/archive/1/479179/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/20138	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://www.securitytracker.com/id?1018687	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.vupen.com/english/advisories/2007/3155	af854a3a-2127-422b-91ae-364da2661108	N/A