{"id":"CVE-2007-5045","published":"2007-09-24T00:00:00Z","modified":"2024-08-07T15:17:28Z","title":"Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox…","vendor":null,"product":null,"tier":"tail","description":{"text":"Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox \"-chrome\" argument.  NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03451,"percentile":0.88967,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.mozilla.org/security/announce/2007/mfsa2007-28.html","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=395942","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/archive/1/479179/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5896","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.vupen.com/english/advisories/2007/3197","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.novell.com/linux/security/advisories/2007_57_mozilla.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/26881","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox","tags":["x_refsource_MISC"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1","tags":["vendor-advisory","x_refsource_SUNALERT"]}],"priority":{"score":17.8,"factors":[{"name":"EPSS percentile","points":17.79}]},"euvd":{"id":"EUVD-2007-5026","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2006-4965-family-cve-2006-4965","parents":[{"from":"CVE-2006-4965","to":"CVE-2007-5045","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.","from":"CVE.org","in":"CVE-2007-5045"}]},{"from":"CVE-2007-3670","to":"CVE-2007-5045","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.","from":"CVE.org","in":"CVE-2007-5045"}]}],"children":[{"from":"CVE-2007-5045","to":"CVE-2007-4673","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"NOTE: this issue may be related to CVE-2006-4965 or CVE-2007-5045.","from":"CVE.org","in":"CVE-2007-4673"}]}]}}