CVE-2007-2388 Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined...
HighCVSS 9.3
EPSS 6.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple quicktime | = 7.1.6 | No fix listed |
References
- APPLE-SA-2007-05-29 vendor-advisory
- 25130 third-party-advisory vendor-advisory
- secunia.com vendor-advisory
- VU#995836 third-party-advisory us-government-resource
- 35576 vdb-entry
- 24221 vdb-entry
- 1018136 vdb-entry
- ADV-2007-1974 vdb-entry vendor-advisory