CVE-2008-1585: Input Validation
Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file: URLs.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1585?
CVE-2008-1585 is considered a critical vulnerability due to its ability to allow remote code execution.
How do I fix CVE-2008-1585?
To mitigate CVE-2008-1585, users should update Apple QuickTime to version 7.5 or later.
What software is affected by CVE-2008-1585?
CVE-2008-1585 affects Apple QuickTime versions prior to 7.5.
How does CVE-2008-1585 exploit work?
CVE-2008-1585 exploits a vulnerability in the way QuickTime handles unrecognized URIs, which can invoke external applications.
Who can be impacted by CVE-2008-1585?
Users with vulnerable versions of Apple QuickTime are at risk of being compromised by this vulnerability.