CVE-2007-0059

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 5.6%

from disclosure to weapon0 days

Published on NVDJan 5

1st PoCJan 3

exploitation probability

5.6%top 8% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem contents via a QuickTime movie (.MOV) with an HREF Track (HREFTrack) that contains an automatic action tag with a local URI, which is executed in a local zone during preview, as exploited by a MySpace worm.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/3077

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://docs.info.apple.com/article.html?artnum=305149 http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html http://osvdb.org/31164 http://projects.info-pull.com/moab/MOAB-03-01-2007.html http://www.gnucitizen.org/blog/backdooring-quicktime-movies/http://www.kb.cert.org/vuls/id/304064