Details of VAR-201003-0203

ID

VAR-201003-0203

CVE

CVE-2010-0536

TITLE

Windows Run on Apple QuickTime Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2010-001337

DESCRIPTION

Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted BMP image. Apple QuickTime is prone to a memory-corruption vulnerability because it fails to sufficiently validate user-supplied data when viewing BMP images. These issues arise when the application handles specially crafted H.264, MPEG-4, and FlashPix video files. Successful exploits may allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts will cause denial-of-service conditions. Versions prior to QuickTime 7.6.6 are vulnerable on Windows 7, Vista, XP, and Mac OS X platforms. Apple QuickTime is a very popular multimedia player

Trust: 2.25

sources: NVD: CVE-2010-0536 // JVNDB: JVNDB-2010-001337 // BID: 39141 // BID: 39087 // VULHUB: VHN-43141

AFFECTED PRODUCTS

vendor:	apple	model:	quicktime	scope:	eq	version:	7.3.1	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.2.1	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.2.0	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.1.6	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.5.0	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.4.5	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.5.5	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.4.0	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.3.0	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.4.1	Trust: 1.6
vendor:	apple	model:	quicktime	scope:	eq	version:	7.1.2	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.1.0	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.1.4	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.1.3	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	lte	version:	7.6.0	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.1.5	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.0.0	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.1.1	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.0.4	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.0.3	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.0.1	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	eq	version:	7.0.2	Trust: 1.0
vendor:	apple	model:	quicktime	scope:	lt	version:	7.6.6	Trust: 0.8
vendor:	apple	model:	quicktime player	scope:	eq	version:	7.6.5	Trust: 0.6
vendor:	apple	model:	quicktime player	scope:	eq	version:	7.6.4	Trust: 0.6
vendor:	apple	model:	quicktime player	scope:	eq	version:	7.6.2	Trust: 0.6
vendor:	apple	model:	quicktime player	scope:	eq	version:	7.6.1	Trust: 0.6
vendor:	apple	model:	quicktime player	scope:	eq	version:	7.6	Trust: 0.6
vendor:	apple	model:	quicktime player	scope:	ne	version:	7.6.6	Trust: 0.6

sources: BID: 39141 // BID: 39087 // JVNDB: JVNDB-2010-001337 // CNNVD: CNNVD-201003-513 // NVD: CVE-2010-0536

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2010-0536
value:	HIGH
Trust: 1.0
NVD:	CVE-2010-0536
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201003-513
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-43141
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2010-0536
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-43141
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-43141 // JVNDB: JVNDB-2010-001337 // CNNVD: CNNVD-201003-513 // NVD: CVE-2010-0536

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-43141 // JVNDB: JVNDB-2010-001337 // NVD: CVE-2010-0536

THREAT TYPE

network

Trust: 0.6

sources: BID: 39141 // BID: 39087

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201003-513

CONFIGURATIONS

sources: JVNDB: JVNDB-2010-001337

PATCH

title:	HT4104	url:	http://support.apple.com/kb/HT4104	Trust: 0.8
title:	HT4104	url:	http://support.apple.com/kb/HT4104?viewlocale=ja_JP	Trust: 0.8

sources: JVNDB: JVNDB-2010-001337

EXTERNAL IDS

db:	NVD	id:	CVE-2010-0536	Trust: 3.1
db:	JVNDB	id:	JVNDB-2010-001337	Trust: 0.8
db:	CNNVD	id:	CNNVD-201003-513	Trust: 0.7
db:	APPLE	id:	APPLE-SA-2010-03-30-1	Trust: 0.6
db:	BID	id:	39141	Trust: 0.4
db:	BID	id:	39087	Trust: 0.3
db:	VULHUB	id:	VHN-43141	Trust: 0.1

sources: VULHUB: VHN-43141 // BID: 39141 // BID: 39087 // JVNDB: JVNDB-2010-001337 // CNNVD: CNNVD-201003-513 // NVD: CVE-2010-0536

REFERENCES

url:	http://lists.apple.com/archives/security-announce/2010//mar/msg00002.html	Trust: 1.7
url:	https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a6969	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0536	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0536	Trust: 0.8
url:	http://www.apple.com/quicktime/	Trust: 0.6

sources: VULHUB: VHN-43141 // BID: 39141 // BID: 39087 // JVNDB: JVNDB-2010-001337 // CNNVD: CNNVD-201003-513 // NVD: CVE-2010-0536

CREDITS

SkyLined of Google, Inc.

Trust: 0.3

sources: BID: 39141

SOURCES

db:	VULHUB	id:	VHN-43141
db:	BID	id:	39141
db:	BID	id:	39087
db:	JVNDB	id:	JVNDB-2010-001337
db:	CNNVD	id:	CNNVD-201003-513
db:	NVD	id:	CVE-2010-0536

LAST UPDATE DATE

2025-04-11T20:18:29.524000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-43141	date:	2017-09-19T00:00:00
db:	BID	id:	39141	date:	2010-03-31T00:00:00
db:	BID	id:	39087	date:	2010-03-31T23:02:00
db:	JVNDB	id:	JVNDB-2010-001337	date:	2010-04-26T00:00:00
db:	CNNVD	id:	CNNVD-201003-513	date:	2010-04-01T00:00:00
db:	NVD	id:	CVE-2010-0536	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-43141	date:	2010-03-31T00:00:00
db:	BID	id:	39141	date:	2010-03-31T00:00:00
db:	BID	id:	39087	date:	2010-03-30T00:00:00
db:	JVNDB	id:	JVNDB-2010-001337	date:	2010-04-26T00:00:00
db:	CNNVD	id:	CNNVD-201003-513	date:	2010-03-31T00:00:00
db:	NVD	id:	CVE-2010-0536	date:	2010-03-31T18:30:00.437