CVE-2008-5406

Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a MOV file with "long arguments," related to an "off by one overflow."

Affected products

Quicktime Player, Itunes

Apple Itunes

= 8.0.2.20

Apple Quicktime

= 7.5.5

Fix

Available

CVSS 2.0

9.3 HIGH

EPSS

9.7% (95th percentile)

Weakness

CWE-119

NVD status

Modified

Published

2008-12-09