CVE-2005-2340: apple quicktime

CVSS: 7.5v2.0HighModified

Published 11-01-2006Last modified 07-08-2024

Vulnerability summary

CVE-2005-2340 is a high (CVSS 7.5) vulnerability in apple quicktime. EPSS estimates a 25.51% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

45/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

25.51%

0%100%

High · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Timeline

11-01-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (QTIF), (2) PICT, or (3) JPEG format image with a long data field.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

25.51%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 25.51% on 19-09-2026

19-09-202619-10-2026

EPSS score

25.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasedoswindowsVerified
Apple QuickTime 6.4/6.5/7.0.x - PictureViewer '.JPEG'/.PICT' File Buffer Overflow
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Apple1 product

quicktime≤ 7.0.3 | 7.0 | 7.0.1 | 7.0.2

1 vendor · 1 product

References

20 links

www.kb.cert.org/vuls/id/687201Third Party AdvisoryX Refsource CERT VNPatchUS Government Resource
archives.neohapsis.com/archives/fulldisclosure/2006-01/0402.htmlMailing ListX Refsource FULLDISC
secunia.com/advisories/18370Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.us-cert.gov/cas/techalerts/TA06-011A.htmlThird Party AdvisoryX Refsource CERTPatchUS Government Resource
www.osvdb.org/22335VDB EntryX Refsource OSVDBPatch
docs.info.apple.com/article.html?artnum=303101Vendor AdvisoryX Refsource APPLEPatch
exchange.xforce.ibmcloud.com/vulnerabilities/24054VDB EntryX Refsource XF
www.osvdb.org/22333VDB EntryX Refsource OSVDBPatch
www.vupen.com/english/advisories/2006/0128VDB EntryX Refsource VUPENVendor Advisory
www.osvdb.org/22334VDB EntryX Refsource OSVDBPatch

Show all 20 references

www.securityfocus.com/bid/16212VDB EntryX Refsource BIDExploit
www.cirt.dk/advisories/cirt-41-advisory.pdfX Refsource MISCVendor Advisory
www.securityfocus.com/bid/16202VDB EntryX Refsource BIDPatch
securityreason.com/securityalert/332Third Party AdvisoryX Refsource SREASON
archives.neohapsis.com/archives/fulldisclosure/2006-01/0392.htmlMailing ListX Refsource FULLDISC
securitytracker.com/id?1015463VDB EntryX Refsource SECTRACKPatch
archives.neohapsis.com/archives/fulldisclosure/2006-01/0398.htmlMailing ListX Refsource FULLDISCVendor Advisory
www.securityfocus.com/archive/1/421547/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/421566/100/0/threadedMailing ListX Refsource BUGTRAQ
www.kb.cert.org/vuls/id/629845Third Party AdvisoryX Refsource CERT VNPatchUS Government Resource

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities