CVE-2006-4389: Medium severity QuickTime Player vulnerability
Published Sep 12, 2006
·Updated
Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via a crafted FlashPix (FPX) file, which triggers an exception that leads to an operation on an uninitialized object.
Affected Software
14 affected components
QuickTime Player=5.0.2
QuickTime Player=6.0
QuickTime Player=6.1
QuickTime Player=6.5
QuickTime Player=6.5.1
QuickTime Player=6.5.2
QuickTime Player=7.0
QuickTime Player=7.0.1
QuickTime Player=7.0.2
QuickTime Player=7.0.3
QuickTime Player=7.0.4
QuickTime Player=7.1
QuickTime Player=7.1.1
QuickTime Player=7.1.2
Remediation
Patch Available
Event History
Sep 12, 2006
CVE Published
11:07 PM
Sep 13, 2006
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-4389?
CVE-2006-4389 is rated as a moderate severity vulnerability that can lead to arbitrary code execution.
2
How do I fix CVE-2006-4389?
To fix CVE-2006-4389, upgrade QuickTime to version 7.1.3 or later.
3
Which versions of QuickTime are affected by CVE-2006-4389?
CVE-2006-4389 affects Apple QuickTime versions 5.0.2 through 7.1.2.
4
Can CVE-2006-4389 be exploited remotely?
Yes, CVE-2006-4389 can be exploited remotely if the user opens a specially crafted FlashPix file.
5
What type of attack does CVE-2006-4389 involve?
CVE-2006-4389 involves an attack that exploits an uninitialized object resulting from opening malicious content.