vulnwire
7.6high

CVE-2007-2175in critical feed3 exploits

Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to ex…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
7.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
83.8%
percentile 100%
Public exploits
3
Exploit-DB

Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the "PWN 2 0WN" contest at CanSecWest 2007.

Exploit prediction (EPSS)

83.80% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-9943 Apple QuickTime for Java 7 - Memory Access (Metasploit) · remote · 2007-04-23
  • EDB-29884 Apple QuickTime 7.1.5 - QTJava toQTPointer() Java Handling Arbitrary Code Execution · remote · 2007-04-23
  • EDB-16295 Apple QTJava - 'toQTPointer()' Arbitrary Memory Access (Metasploit) · remote · 2010-09-20

CVSS scores

Assigned byVersionScoreVector
NVD2.07.6AV:N/AC:H/Au:N/C:C/I:C/A:C

References

  • zerodayinitiative.com /advisories/ZDI-07-023.html · x_refsource_MISC, x_transferred
  • cansecwest.com /post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/33827 · vdb-entry, x_refsource_XF, x_transferred
  • securitytracker.com /id?1017950 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.apple.com /archives/security-announce/2007/May/msg00001.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • theregister.co.uk /2007/04/20/pwn-2-own_winner/ · x_refsource_MISC, x_transferred
  • docs.info.apple.com /article.html?artnum=305446 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /archive/1/467319/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • matasano.com /log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/ · x_refsource_MISC, x_transferred
  • osvdb.org /34178 · vdb-entry, x_refsource_OSVDB, x_transferred
  • kb.cert.org /vuls/id/420668 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • matasano.com /log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/ · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.