« Volver al listado

CVE-2008-5406

Estado: ModificadaAlta (9.3)—

Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a MOV file with "long arguments," related to an "off by one overflow."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Apple — ItunesApple — Quicktime

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-5406",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-12-10T06:44:42.283",
  "references": [
    {
      "url": "http://securityreason.com/securityalert/4704",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/32540",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46984",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/7296",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/4704",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/32540",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46984",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/7296",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a MOV file with \"long arguments,\" related to an \"off by one overflow.\""
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer basado en pila en Apple QuickTime Player 7.5.5 e iTunes 8.0.2.20, permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) y probablemente la ejecución de código de su elección a través de un archivo MOV con \"una argumento largo\". Relacionado con un \"error de superación de límite (off-by-one)\"."
    }
  ],
  "lastModified": "2026-06-16T22:59:54.913",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:itunes:8.0.2.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5D3F603-BD64-4C7C-978B-1D3B9A04BB89"
            },
            {
              "criteria": "cpe:2.3:a:apple:quicktime:7.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D22D0674-0EC7-4176-97FB-940F2F7D6AFC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}