CVE-2010-3788: Input Validation

Published Nov 16, 2010

Updated

QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of JP2 image data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 file.

Affected Software

12 affected components

Apple QuickTime

Apple iOS and macOS=10.6.0

Apple iOS and macOS=10.6.1

Apple iOS and macOS=10.6.2

Apple iOS and macOS=10.6.3

Apple iOS and macOS=10.6.4

Apple QuickTime

Apple Mac OS X Server=10.6.0

Apple Mac OS X Server=10.6.1

Apple Mac OS X Server=10.6.2

Apple Mac OS X Server=10.6.3

Apple Mac OS X Server=10.6.4

Remediation

Patch Available

http://support.apple.com/kb/HT4435

Event History

Nov 16, 2010

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

10:00 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-3788?

CVE-2010-3788 has a high severity rating due to its potential for remote code execution and denial of service.

How do I fix CVE-2010-3788?

To fix CVE-2010-3788, update QuickTime or Mac OS X to version 10.6.5 or later.

What types of attacks can CVE-2010-3788 facilitate?

CVE-2010-3788 can facilitate remote code execution or cause application crashes through crafted JP2 files.

Which systems are affected by CVE-2010-3788?

CVE-2010-3788 affects Apple Mac OS X versions 10.6.0 to 10.6.4 and QuickTime versions prior to the fix.

Is CVE-2010-3788 being actively exploited?

CVE-2010-3788 is considered to be a serious vulnerability, making it a potential target for exploitation.