CVE-2007-0051 Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string spe...
MediumCVSS 6.8
EPSS 9.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary code via a crafted photocast with format string specifiers in the title of an RSS iPhoto feed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple iphoto | = 6.0.5 | No fix listed |
References
- 20070104 DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability' mailing-list
- docs.info.apple.com
- APPLE-SA-2007-03-13 vendor-advisory
- 31165 vdb-entry
- projects.info-pull.com exploit vendor-advisory
- 23615 third-party-advisory vendor-advisory
- www.digitalmunition.com
- 20070104 DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability' mailing-list
- 21871 vdb-entry
- ADV-2007-0057 vdb-entry vendor-advisory
- iphoto-xmltitle-format-string(31281) vdb-entry
- 3080 exploit