Description
Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.apple.com/archives/security-announce/2007/May/msg00005.html ↗
- http://www.vupen.com/english/advisories/2007/1974 ↗
- http://www.securitytracker.com/id?1018136 ↗
- http://www.kb.cert.org/vuls/id/995836 ↗
- http://www.osvdb.org/35576 ↗
- http://secunia.com/advisories/25130 ↗
- http://www.securityfocus.com/bid/24221 ↗
- http://secunia.com/secunia_research/2007-52/advisory/ ↗