CVE-2010-0519 Integer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a FlashPix image with a malformed S...
MediumCVSS 6.8
EPSS 9.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Integer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a FlashPix image with a malformed SubImage Header Stream containing a NumberOfTiles field with a large value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple mac os x | = 10.6.0 | No fix listed |
| apple mac os x | = 10.6.1 | No fix listed |
| apple mac os x | = 10.6.2 | No fix listed |
| apple mac os x server | = 10.6.0 | No fix listed |
| apple mac os x server | = 10.6.1 | No fix listed |
| apple mac os x server | = 10.6.2 | No fix listed |
References
- APPLE-SA-2010-03-29-1 patch vendor-advisory
- APPLE-SA-2010-03-30-1 vendor-advisory
- support.apple.com patch vendor-advisory
- 20100402 ZDI-10-043: Apple QuickTime FlashPix NumberOfTiles Remote Code Execution Vulnerability mailing-list
- www.zerodayinitiative.com
- oval:org.mitre.oval:def:7498 signature vdb-entry