CVE-2007-5045 Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via....
HighCVSS 9.3
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox "-chrome" argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple quicktime | <= 7.1.5 | No fix listed |
| mozilla Firefox | <= 2.0.0.6 | No fix listed |
References
- HPSBUX02153 vendor-advisory
- 26881 patch third-party-advisory vendor-advisory
- 201516 vendor-advisory
- www.gnucitizen.org
- www.mozilla.org patch
- SUSE-SA:2007:057 vendor-advisory
- 20070912 0DAY: QuickTime pwns Firefox mailing-list
- ADV-2007-3197 vdb-entry
- bugzilla.mozilla.org
- oval:org.mitre.oval:def:5896 signature vdb-entry