Unscored severity · published Nov 29, 2007
CVE-2007-6166
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP)…
–
CVSS
41.8%
EPSS
No
On KEV
Description
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.
Exploitation
Is it being used?
Exploit prediction (EPSS)41.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quicktime · Apple
through 7.3; 3.0; 4.1.2; 5.0; 5.0.1; 5.0.2; +18 more · source: NVD
SA
Safari · Apple
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-6166
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-6166
docs.info.apple.com
http://docs.info.apple.com/article.html?artnum=307176
lists.apple.com
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00000.html
Vendor Advisory
http://secunia.com/advisories/27755
Vendor Advisory
http://secunia.com/advisories/29182
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200803-08.xml
securityreason.com
http://securityreason.com/securityalert/3410
More from Quicktime
9.8
CVE-2011-3428
Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code
7.8
CVE-2017-2218
Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory
6.6
CVE-2015-7117
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a…
6.6
CVE-2015-7092
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX…
6.6
CVE-2015-7091
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a…