CVE-2007-5045 Command injection in n/a

Critical 9.3 Published 24 Sep 2007 Updated 7 Aug 2024

Remote attackers can execute arbitrary commands via a malicious QuickTime Media Link file when Firefox is installed, requiring user interaction to open the file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2007-5045?

CVE-2007-5045 is a critical command injection vulnerability in Apple Quicktime, published on 24 Sep 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox "-chrome" argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.

Weakness: CWE-94

Which versions are affected by CVE-2007-5045?

It affects 2 products.

Products include Apple Quicktime, Mozilla Firefox.

How do I fix CVE-2007-5045?

No fix has been published for CVE-2007-5045 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2007-5045 being exploited?

There is no known exploitation of CVE-2007-5045 in the wild and no public exploit code.

All Apple Quicktime vulnerabilities

Sources

Also known as GHSA-6x5g-m8wv-w9v6.