Apple Quicktime vulnerabilities

246 CVEs affecting Apple Quicktime, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-2218, published 2017-07-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-0257, published 2011-08-15. High severity, CVSS 9.3. EPSS: 60.1% chance of exploitation in the next 30 days. Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PnSize opcode in a PICT file…
CVE-2007-0015, published 2007-01-01. Medium severity, CVSS 6.8. EPSS: 48.8% chance of exploitation in the next 30 days. Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.
CVE-2010-1818, published 2010-08-31. High severity, CVSS 9.3. EPSS: 42.7% chance of exploitation in the next 30 days. The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk…
CVE-2007-6166, published 2007-11-29. High severity, CVSS 9.3. EPSS: 41.9% chance of exploitation in the next 30 days. Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute…
CVE-2012-3752, published 2012-11-09. High severity, CVSS 9.3. EPSS: 36% chance of exploitation in the next 30 days. Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime…
CVE-2012-3753, published 2012-11-09. High severity, CVSS 9.3. EPSS: 35.1% chance of exploitation in the next 30 days. Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type.
CVE-2010-1799, published 2010-08-16. High severity, CVSS 9.3. EPSS: 33.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application…
CVE-2013-1017, published 2013-05-24. High severity, CVSS 9.3. EPSS: 32.6% chance of exploitation in the next 30 days. Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file.
CVE-2012-0663, published 2012-05-16. High severity, CVSS 9.3. EPSS: 28.3% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML…
CVE-2005-2340, published 2005-12-31. High severity, CVSS 7.5. EPSS: 25.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (QTIF), (2) PICT, or (3) JPEG format image with a…

Latest

CVE-2017-2218, published 2017-07-07. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2011-3428, published 2017-04-24. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code.
CVE-2015-7117, published 2016-01-09. Medium severity, CVSS 6.6. EPSS: 1.7% chance of exploitation in the next 30 days. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different…
CVE-2015-7092, published 2016-01-09. Medium severity, CVSS 6.6. EPSS: 1.8% chance of exploitation in the next 30 days. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX frame within an ID3…
CVE-2015-7091, published 2016-01-09. Medium severity, CVSS 6.6. EPSS: 1.4% chance of exploitation in the next 30 days. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different…
CVE-2015-7090, published 2016-01-09. Medium severity, CVSS 6.6. EPSS: 1.6% chance of exploitation in the next 30 days. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different…
CVE-2015-7089, published 2016-01-09. Medium severity, CVSS 6.6. EPSS: 1.6% chance of exploitation in the next 30 days. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different…
CVE-2015-7088, published 2016-01-09. Medium severity, CVSS 6.6. EPSS: 1.7% chance of exploitation in the next 30 days. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different…
CVE-2015-7087, published 2016-01-09. Medium severity, CVSS 6.6. EPSS: 1.6% chance of exploitation in the next 30 days. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different…
CVE-2015-7086, published 2016-01-09. Medium severity, CVSS 6.6. EPSS: 1.3% chance of exploitation in the next 30 days. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different…