CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
Percentile
99.6%
Added: 07/09/2012
CVE: CVE-2012-0663
BID: 53571
OSVDB: 81934
QuickTime is a media player for Windows and Mac OS platforms.
Apple QuickTime 7.7.1 and earlier versions are vulnerable to buffer overflow when parsing XML elements within a TeXML file. The QuickTime3GPP.qtx
QuickTime Extension image file does not properly validate the length of data within certain sub-fields. By enticing a user to open a specially crafted TeXML file, a remote attacker could exploit this vulnerability to execute arbitrary code in the context of the user.
Upgrade to Apple QuickTime 7.7.2 or later.
<http://www.zerodayinitiative.com/advisories/ZDI-12-107/>
<http://support.apple.com/kb/HT5261>
This exploit has been tested against Apple QuickTime 7.7.1 on Windows XP SP3 English (DEP OptIn).
The user must open the exploit file in a vulnerable version of Apple QuickTime.
Windows