Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-3627

Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.

Published

2008-09-11T01:13:09.853

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

10.0

Weaknesses

Type: Primary
CWE-399

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apple	quicktime	< 7.5.5	Yes

References

http://lists.apple.com/archives/security-announce//2008/Sep/msg00000.html Mailing List, Vendor Advisory ([email protected])
http://secunia.com/advisories/31821 Third Party Advisory ([email protected])
http://securitytracker.com/id?1020841 Third Party Advisory, VDB Entry ([email protected])
http://support.apple.com/kb/HT3027 Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/496163/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/496175/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/496176/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/31086 Patch, Third Party Advisory, VDB Entry ([email protected])
http://www.vupen.com/english/advisories/2008/2527 Third Party Advisory ([email protected])
http://www.zerodayinitiative.com/advisories/ZDI-08-060/ Third Party Advisory, VDB Entry ([email protected])
http://www.zerodayinitiative.com/advisories/ZDI-08-061/ Third Party Advisory, VDB Entry ([email protected])
http://www.zerodayinitiative.com/advisories/ZDI-08-062/ Third Party Advisory, VDB Entry ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16164 Third Party Advisory ([email protected])
http://lists.apple.com/archives/security-announce//2008/Sep/msg00000.html Mailing List, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/31821 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1020841 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://support.apple.com/kb/HT3027 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/496163/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/496175/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/496176/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/31086 Patch, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2008/2527 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.zerodayinitiative.com/advisories/ZDI-08-060/ Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.zerodayinitiative.com/advisories/ZDI-08-061/ Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.zerodayinitiative.com/advisories/ZDI-08-062/ Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16164 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)