CVE-2009-0956: Critical severity quicktime player vulnerability
Published Jun 2, 2009
·Updated
Apple QuickTime before 7.6.2 does not properly initialize memory before use in handling movie files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a movie containing a user data atom of size zero.
Affected Software
127 affected components
QuickTime Player=7.1.5
QuickTime Player=7.3.1
QuickTime Player=7.5.5
QuickTime Player=7.4.0
QuickTime Player=6.5.1
QuickTime Player=5.0.2
QuickTime Player=6.1.0
QuickTime Player=6.1.1
QuickTime Player=6.5.2
QuickTime Player=6.0.1
QuickTime Player=7.0.3
QuickTime Player=6.2.0
QuickTime Player=5.0
QuickTime Player=7.0.3
QuickTime Player=6.1.1
QuickTime Player=7.5.0
QuickTime Player=7.1.5
QuickTime Player=7.1.6
QuickTime Player=7.5.0
QuickTime Player=6.0.0
QuickTime Player=7.2.1
QuickTime Player=7.1.6
QuickTime Player=6.4.0
QuickTime Player=7.0.1
QuickTime Player=7.1.4
QuickTime Player=7.4.1
QuickTime Player=7.0
QuickTime Player=6.3.0
QuickTime Player=7.0.2
QuickTime Player=7.0
QuickTime Player=6.2.0
QuickTime Player=7.1.6
QuickTime Player=7.1.5
QuickTime Player=7.0.0
QuickTime Player=7.4.1
QuickTime Player=7.0.3
QuickTime Player=7.4.5
QuickTime Player=7.4.4
QuickTime Player=4.1.2
QuickTime Player=7.4.5
QuickTime Player=7.1.4
QuickTime Player=7.2.1
QuickTime Player=7.3.1
QuickTime Player=7.1.2
QuickTime Player=5.0.2
QuickTime Player=6.1.0
QuickTime Player=7.1.3
QuickTime Player=7.0.2
QuickTime Player=7.2
QuickTime Player=7.1.3
QuickTime Player=5.0.2
QuickTime Player=4.1.2
QuickTime Player=6.1.0
QuickTime Player=6.0.1
QuickTime Player=7.2.0
QuickTime Player=7.0.1
QuickTime Player=5.0.1
QuickTime Player=6.4.0
QuickTime Player=6.2.0
QuickTime Player=6.0.2
QuickTime Player=6.5.1
QuickTime Player=7.6.0
QuickTime Player=7.5.0
QuickTime Player=6.0.2
QuickTime Player=7.0.2
QuickTime Player=5.0.1
QuickTime Player=7.3.0
QuickTime Player=7.0.1
QuickTime Player=7.4
QuickTime Player=6.4.0
QuickTime Player=7.0.4
QuickTime Player=6.5.1
QuickTime Player=3.0
QuickTime Player=7.0.4
QuickTime Player=7.2.0
QuickTime Player=7.1.1
QuickTime Player=4.1.2
QuickTime Player=6.1
QuickTime Player=7.1.1
QuickTime Player=6.5
QuickTime Player=7.4.0
QuickTime Player=7.3.1.70
QuickTime Player=7.1.2
QuickTime Player=7.4.0
QuickTime Player=7.1
QuickTime Player=7.0.4
QuickTime Player=6.0.1
QuickTime Player=7.1.1
QuickTime Player=7.1.0
QuickTime Player=6.0.2
QuickTime Player=6.3.0
QuickTime Player=7.3.0
QuickTime Player=7.0.2
QuickTime Player=5.0.1
QuickTime Player=6.0.0
QuickTime Player=7.3.1
QuickTime Player=7.3
QuickTime Player=7.0.1
QuickTime Player=7.4.1
QuickTime Player=6.5.0
QuickTime Player=6.3.0
QuickTime Player=7.1.4
QuickTime Player=7.3.0
QuickTime Player=6.0
QuickTime Player=6.5.2
QuickTime Player=7.5
QuickTime Player=6.0.0
QuickTime Player=6.5.0
QuickTime Player=7.5.5
QuickTime Player=7.1.3
QuickTime Player=6.5.0
QuickTime Player=7.0
QuickTime Player=7.1.0
QuickTime Player=7.2.0
QuickTime Player=7.1.2
QuickTime Player=7.5.5
QuickTime Player=6.1.1
QuickTime Player=7.2
QuickTime Player=6.5.2
QuickTime Player=7.0.0
QuickTime Player=7.2.1
QuickTime Player=7.4.5
QuickTime Player=7.1.0
QuickTime Player=6.0
QuickTime Player=7.0.0
QuickTime Player<=7.6.1
QuickTime Player
Remediation
Patch Available
Patch Available
Patch Available
Event History
Jun 2, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-0956?
CVE-2009-0956 is classified as a high severity vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2009-0956?
The best way to fix CVE-2009-0956 is to update Apple QuickTime to version 7.6.2 or later.
3
Which versions of QuickTime are affected by CVE-2009-0956?
CVE-2009-0956 affects Apple QuickTime versions prior to 7.6.2.
4
What kind of attack can CVE-2009-0956 facilitate?
CVE-2009-0956 can facilitate remote code execution or cause a denial of service due to application crashes.
5
Is there a known exploit for CVE-2009-0956?
Yes, CVE-2009-0956 has been known to be exploited in the wild due to its ability to handle specially crafted movie files.