ByteOS Network

NVD Vulnerability Details :

CVE-2007-0059

Modified

Source-cve@mitre.org

Published At-05 Jan, 2007 | 00:28

Updated At-30 Oct, 2018 | 16:25

Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

Apple Inc.

>>quicktime>>Versions up to 7.1.3(inclusive)

cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*

Apple Inc.

>>quicktime>>3.0

cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-Other	Primary	nvd@nist.gov

CWE ID: NVD-CWE-Other

Type: Primary

Source: nvd@nist.gov

Vendor Statements

Organization : Apple

Last Modified : 2007-03-19T00:00:00

This issue is addressed in QuickTime 7.1.5, which was released on March 5. Information on the security fixes provided in QuickTime 7.1.5, and links to obtain the update are provided in: http://docs.info.apple.com/article.html?artnum=305149

References

Hyperlink	Source	Resource
http://docs.info.apple.com/article.html?artnum=305149	cve@mitre.org	N/A
http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html	cve@mitre.org	N/A
http://osvdb.org/31164	cve@mitre.org	N/A
http://projects.info-pull.com/moab/MOAB-03-01-2007.html	cve@mitre.org	Exploit
http://www.gnucitizen.org/blog/backdooring-quicktime-movies/	cve@mitre.org	Vendor Advisory
http://www.kb.cert.org/vuls/id/304064	cve@mitre.org	US Government Resource