CVE-2009-0956

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Apple QuickTime before 7.6.2 does not properly initialize memory before use in handling movie files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a movie containing a user data atom of size zero.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-399

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2009/Jun/msg00000.htmlPatch, Vendor Advisory
http://secunia.com/advisories/35091Vendor Advisory
http://support.apple.com/kb/HT3591Patch, Vendor Advisory
http://www.securityfocus.com/bid/35162Patch
http://www.securitytracker.com/id?1022314
http://www.vupen.com/english/advisories/2009/1469Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50896
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16188
http://lists.apple.com/archives/security-announce/2009/Jun/msg00000.htmlPatch, Vendor Advisory
http://secunia.com/advisories/35091Vendor Advisory
http://support.apple.com/kb/HT3591Patch, Vendor Advisory
http://www.securityfocus.com/bid/35162Patch
http://www.securitytracker.com/id?1022314
http://www.vupen.com/english/advisories/2009/1469Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50896
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16188

Timeline

Published: Jun 2, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-09579.3Heap-based buffer overflow in Apple QuickTime before 7.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (a CVE-2009-09584.3Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an CVE-2009-09597.1The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause CVE-2009-09604.3The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not provide an option to disable CVE-2009-09615.0The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog wh CVE-2009-09627.5Unspecified vulnerability in Futomi's CGI Cafe MP Form Mail CGI eCommerce 1.3.0 and earlier, and CGI Professional 3.2.2 and earlier, allows CVE-2009-09637.5Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via CVE-2009-09647.5UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain priv CVE-2009-09657.5SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers to execute arbitrar CVE-2009-09667.5PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code CVE-2009-09674.0The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large n CVE-2009-09687.5SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands