CVE Feed

    Dashboard / CVE / CVE-2007-5045

    CVE-2007-5045

    Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox "-chrome" argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.

    Published:Sep 24, 2007
    Last Modified:Apr 23, 2026
    EPS:Sep 24, 2007
    EPSS Score:0.02046
    CVSS Score:9.3

    Affected Products

    Vendor
    Apple
    Product
    Quicktime
    Vendor
    Mozilla
    Product
    Firefox

    Exploits

    No exploit reference

    Related CVEs

    CVE-2017-2218 (CVSS 7.8) — Untrusted search path vulnerability in Installer of QuickTime for Windows allows an attacker to gain privilege…
    CVE-2011-3428 (CVSS 9.8) — Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code.…
    CVE-2015-7092 (CVSS 6.6) — Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (h…
    CVE-2015-7090 (CVSS 6.6) — Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (m…
    CVE-2015-7085 (CVSS 6.6) — Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (m…
    CVE-2015-7088 (CVSS 6.6) — Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (m…
    CVE-2015-7091 (CVSS 6.6) — Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (m…
    CVE-2015-7089 (CVSS 6.6) — Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (m…
    CVE-2015-7086 (CVSS 6.6) — Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (m…
    CVE-2015-7087 (CVSS 6.6) — Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (m…

    References

    http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
    http://secunia.com/advisories/26881
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
    http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox
    http://www.mozilla.org/security/announce/2007/mfsa2007-28.html
    http://www.novell.com/linux/security/advisories/2007_57_mozilla.html
    http://www.securityfocus.com/archive/1/479179/100/0/threaded
    http://www.vupen.com/english/advisories/2007/3197
    https://bugzilla.mozilla.org/show_bug.cgi?id=395942
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5896
    http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
    http://secunia.com/advisories/26881
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
    http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox
    http://www.mozilla.org/security/announce/2007/mfsa2007-28.html
    http://www.novell.com/linux/security/advisories/2007_57_mozilla.html
    http://www.securityfocus.com/archive/1/479179/100/0/threaded
    http://www.vupen.com/english/advisories/2007/3197
    https://bugzilla.mozilla.org/show_bug.cgi?id=395942
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5896

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High