Unscored severity · published Sep 11, 2008
CVE-2008-3627
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar,…
–
CVSS
8.6%
EPSS
No
On KEV
Description
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quicktime · Apple
before 7.5.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3627
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3627
Mailing List
http://lists.apple.com/archives/security-announce//2008/Sep/msg00000.html
Third Party Advisory
http://secunia.com/advisories/31821
Third Party Advisory
http://securitytracker.com/id?1020841
Vendor Advisory
http://support.apple.com/kb/HT3027
www.securityfocus.com
http://www.securityfocus.com/archive/1/496163/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/496175/100/0/threaded
More from Quicktime
9.8
CVE-2011-3428
Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code
7.8
CVE-2017-2218
Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory
6.6
CVE-2015-7117
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a…
6.6
CVE-2015-7092
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX…
6.6
CVE-2015-7091
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a…