CVE-2006-4965

Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter that identifies resources outside of the original domain. NOTE: as of 20070912, this issue has been demonstrated by using instances of Components.interfaces.nsILocalFile and Components.interfaces.nsIProcess to execute arbitrary local files within Firefox and possibly Internet Explorer.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

13.13% chance of exploitation in the next 30 days, 96th percentile

Published

2006-09-25

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/28639

References

• CVE Record
• NVD entry

Related

• CVE-2006-4963
• CVE-2006-4966
• CVE-2006-4962
• CVE-2006-4968
• CVE-2006-4961
• CVE-2006-4969