CVE-2006-4965

Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media…

published September 25, 2006

CVSS
—
EPSS
13%
Percentile
96.3
In the wild
Unconfirmed
What it is

Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter that identifies resources outside of the original domain. NOTE: as of 20070912, this issue has been demonstrated by using instances of Components.interfaces.nsILocalFile and Components.interfaces.nsIProcess to execute arbitrary local files within Firefox and possibly Internet Explorer.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13129 · 96.3th percentile
Published
2006-09-25T00:00Z
EPSS history
Timeline
  • 25 SEP 00:00Z
    Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media…
    cvelistv5