Rapid7 Vulnerability & Exploit Database

QuickTime: memory corruption allows arbitrary code execution via malicious PICT images (CVE-2010-3800)

Back to Search

QuickTime: memory corruption allows arbitrary code execution via malicious PICT images (CVE-2010-3800)

Severity
9
CVSS
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
Published
12/09/2010
Created
07/25/2018
Added
12/09/2010
Modified
01/30/2020

Description

A memory corruption issue exists in QuickTime's handling of PICT files. Viewing a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of PICT files. Credit to Moritz Jodeit of n.runs AG and Damian Put, working with TippingPoint's Zero Day Initiative, and Hossein Lotfi (s0lute), working with VeriSign iDefense Labs for reporting this issue.

Solution(s)

  • quicktime-upgrade-7_6_9

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;