Unscored severity · published Dec 27, 2013
CVE-2010-1819
Untrusted search path vulnerability in the Picture Viewer in Apple QuickTime before 7.6.8 allows local users, and possibly remote attackers, to execute arbitrary code and conduct…
–
CVSS
4.7%
EPSS
No
On KEV
Description
Untrusted search path vulnerability in the Picture Viewer in Apple QuickTime before 7.6.8 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) CoreVideo.dll, (2) CoreGraphics.dll, or (3) CoreAudioToolbox.dll that is located in the same folder as a .pic image file.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quicktime · Apple
through 7.6.7; 7.6.0; 7.6.1; 7.6.2; 7.6.5; 7.6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1819
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1819
Patch
http://lists.apple.com/archives/security-announce/2010/Sep/msg00003.html
Vendor Advisory
http://support.apple.com/kb/HT4339
www.fortiguard.com
http://www.fortiguard.com/advisory/FGA-2010-46/
More from Quicktime
9.8
CVE-2011-3428
Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code
7.8
CVE-2017-2218
Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory
6.6
CVE-2015-7117
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a…
6.6
CVE-2015-7092
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX…
6.6
CVE-2015-7091
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a…