The version of Apple QuickTime installed on the remote Windows host is prior to 7.7.9. It is, therefore, affected by multiple remote code execution vulnerabilities due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a crafted movie file, to execute arbitrary code or cause a denial of service through memory corruption.

リモート Windows ホストにインストールされた Apple QuickTime のバージョンは、7.7.9 以前のバージョンです。このため、ユーザー指定の入力を不適切に検証しているため、複数のリモートコードの実行の脆弱性による影響を受けます。認証されていないリモートの攻撃者が、これらを悪用して、細工された動画ファイルを通じて、任意のコードを実行するか、メモリ破損によりサービス拒否を引き起こす可能性があります。

远程 Windows 主机上安装的 Apple QuickTime 版本低于 7.7.9。因此，由于未正确验证用户提供的输入，它会受多个远程代码执行漏洞的影响。未经认证的远程攻击者可利用这些漏洞，通过特别构建的影片文件执行任意代码，或通过内存损坏造成拒绝服务。

遠端 Windows 主機上安裝的 Apple QuickTime 版本比 7.7.9 舊。因此，會受到多個遠端程式碼執行弱點影響，這些弱點是因不當驗證使用者提供的輸入所導致。未經驗證的遠端攻擊者可惡意利用這些弱點，透過特製的影片檔執行任意程式碼，或透過記憶體損毀造成拒絕服務。

Versions of QuickTime older than 7.7.9 are affected by the following vulnerabilities :

  - A flaw is triggered as user-supplied input is not properly validated. With a specially crafted movie file, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7091) 
 - A flaw in the 'QuickTime!0x73b390()' function is triggered as user-supplied input is not properly validated when handling dref atoms. With a specially crafted movie file, a context-dependent attacker can trigger an out-of-bounds access and cause a crash, or potentially execute arbitrary code. (CVE-2015-7090) 
 - An overflow condition is triggered as user-supplied input is not properly validated when handling ID3 version tags in MP3 file. With a specially crafted TXXX frame, a context-dependent attacker can cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2015-7092) 
 - A flaw is triggered as user-supplied input is not properly validated. With a specially crafted movie file, a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2015-7117)

ID	名稱	產品	系列	已發布	已更新	嚴重性
87848	Apple QuickTime < 7.7.9 Multiple RCE (Windows)	Nessus	Windows	2016/1/11	2019/11/22	medium
87848	7.7.9 より前の Apple QuickTime における複数の RCE（Windows）	Nessus	Windows	2016/1/11	2019/11/22	medium
87848	Apple QuickTime < 7.7.9 多种 RCE (Windows)	Nessus	Windows	2016/1/11	2019/11/22	medium
87848	Apple QuickTime < 7.7.9 多個 RCE (Windows)	Nessus	Windows	2016/1/11	2019/11/22	medium
9306	Apple QuickTime < 7.7.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/4/20	2019/3/6	critical

偵測

搜尋 Plugin

medium

medium

medium

medium

critical