CVE-2016-2399

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3800
http://www.nemux.org/2016/02/23/libquicktime-1-2-4/Exploit, Technical Description, Third Party Advisory
http://www.securityfocus.com/bid/95880Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/135899/libquicktime-1.2.4-Integer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/39487/
http://www.debian.org/security/2017/dsa-3800
http://www.nemux.org/2016/02/23/libquicktime-1-2-4/Exploit, Technical Description, Third Party Advisory
http://www.securityfocus.com/bid/95880Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/135899/libquicktime-1.2.4-Integer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/39487/

Timeline

Published: Jan 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-24025.9OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain wit CVE-2016-24039.8Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid us CVE-2016-24047.5Huawei switches S5700, S6700, S7700, S9700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R005C00SPC500, V200R00 CVE-2016-24058.8Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of servi CVE-2016-24064.3The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to CVE-2016-24087.8Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow restricted users to gain privi CVE-2016-24098.1A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application CVE-2016-24107.4A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages CVE-2016-24116.5A Qualcomm Power Management kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application tha CVE-2016-24127.8include/core/SkPostConfig.h in Skia, as used in System_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x b CVE-2016-24137.8media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a ha CVE-2016-24146.2The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size va