Unscored severity · published Sep 25, 2006
CVE-2006-4965
Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with…
–
CVSS
13.4%
EPSS
No
On KEV
Description
Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter that identifies resources outside of the original domain. NOTE: as of 20070912, this issue has been demonstrated by using instances of Components.interfaces.nsILocalFile and Components.interfaces.nsIProcess to execute arbitrary local files within Firefox and possibly Internet Explorer.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.4% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quicktime · Apple
7.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4965
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4965
docs.info.apple.com
http://docs.info.apple.com/article.html?artnum=305149
lists.apple.com
http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
Exploit
http://secunia.com/advisories/22048
Vendor Advisory
http://secunia.com/advisories/27414
securityreason.com
http://securityreason.com/securityalert/1631
www.gnucitizen.org
http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox
More from Quicktime
9.8
CVE-2011-3428
Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code
7.8
CVE-2017-2218
Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory
6.6
CVE-2015-7117
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a…
6.6
CVE-2015-7092
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX…
6.6
CVE-2015-7091
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a…