CVE-2007-2175

Estado: ModificadaAlta (7.6)—💥 Exploit

Las extensiones de Apple QuickTime Java (en la biblioteca QTJava .dll), como es usado en Safari y otros navegadores, y cuando Java está habilitado, permiten que los atacantes remotos ejecuten código arbitrario por medio de parámetros hacia el método toQTPointer en quicktime.util.QTHandleRef, que puede ser usado para modificar memoria arbitraria al crear objetos QTPointerRef, como se demostró durante el concurso "PWN 2 0WN" en CanSecWest 2007

CVSS

Versión: 2.0
Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Puntuación base: 7.6

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 84%
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 7/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Módulo de Metasploit (exploit fiable y al alcance de cualquiera) · Apple QTJava toQTPointer() Arbitrary Memory Access
Publicado en Exploit-DB · Apple QTJava - 'toQTPointer()' Arbitrary Memory Access (Metasploit) (20/9/2010)
Publicado en Exploit-DB · Apple QuickTime 7.1.5 - QTJava toQTPointer() Java Handling Arbitrary Code Execution (23/4/2007)
Publicado en Exploit-DB · Apple QuickTime for Java 7 - Memory Access (Metasploit) (23/4/2007)

Tecnologías afectadas (1)

Apple — Safari

CWE

NVD-CWE-Other

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2007-2175",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-04-24T16:19:00.000",
  "references": [
    {
      "url": "http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://docs.info.apple.com/article.html?artnum=305446",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2007/May/msg00001.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/420668",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/34178",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/467319/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1017950",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-07-023.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33827",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://docs.info.apple.com/article.html?artnum=305446",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2007/May/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/420668",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/34178",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/467319/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1017950",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-07-023.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33827",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the \"PWN 2 0WN\" contest at CanSecWest 2007."
    },
    {
      "lang": "es",
      "value": "Las extensiones de Apple QuickTime Java (en la biblioteca QTJava .dll),  como es usado en Safari y otros navegadores, y cuando Java está habilitado, permiten que los atacantes remotos ejecuten código arbitrario por medio de parámetros hacia el método toQTPointer en quicktime.util.QTHandleRef, que puede ser usado para modificar memoria arbitraria al crear objetos QTPointerRef, como se demostró durante el concurso \"PWN 2 0WN\" en CanSecWest 2007"
    }
  ],
  "lastModified": "2026-06-16T22:39:04.927",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE370CAA-04B3-434E-BD5B-1D87DE596C10"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}