CVE-2009-0003

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via an AVI movie file with an invalid nBlockAlign value in the _WAVEFORMATEX structure.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.htmlPatch, Vendor Advisory
http://osvdb.org/51526
http://secunia.com/advisories/33632Vendor Advisory
http://support.apple.com/kb/HT3403
http://www.securityfocus.com/bid/33387
http://www.us-cert.gov/cas/techalerts/TA09-022A.htmlUS Government Resource
http://www.vupen.com/english/advisories/2009/0212Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-09-006/
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6218
http://lists.apple.com/archives/security-announce/2009/Jan/msg00000.htmlPatch, Vendor Advisory
http://osvdb.org/51526
http://secunia.com/advisories/33632Vendor Advisory
http://support.apple.com/kb/HT3403
http://www.securityfocus.com/bid/33387
http://www.us-cert.gov/cas/techalerts/TA09-022A.htmlUS Government Resource
http://www.vupen.com/english/advisories/2009/0212Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-09-006/
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6218

Timeline

Published: Jan 21, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-00049.3Buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly ex CVE-2009-00059.3Unspecified vulnerability in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and p CVE-2009-00069.3Integer signedness error in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and po CVE-2009-00079.3Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and CVE-2009-00087.6Unspecified vulnerability in Apple QuickTime MPEG-2 Playback Component before 7.60.92.0 on Windows allows remote attackers to cause a denial CVE-2009-00096.8Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (app CVE-2009-00109.3Integer underflow in QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7, and Apple QuickTime before 7.6.2, allows remote att CVE-2009-00117.2Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure f CVE-2009-001210.0Heap-based buffer overflow in CoreText in Apple Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via a crafted Unicode stri CVE-2009-00132.1dscl in DS Tools in Apple Mac OS X 10.4.11 and 10.5.6 requires that passwords must be provided as command line arguments, which allows local CVE-2009-00142.1Folder Manager in Apple Mac OS X 10.5.6 uses insecure default permissions when recreating a Downloads folder after it has been deleted, whic CVE-2009-00154.9Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information