CVE-2006-4965

Description

Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter that identifies resources outside of the original domain. NOTE: as of 20070912, this issue has been demonstrated by using instances of Components.interfaces.nsILocalFile and Components.interfaces.nsIProcess to execute arbitrary local files within Firefox and possibly Internet Explorer.

Weakness classification

• CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references

• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Exploit, Vendor Advisory
• cve@mitre.org — Vendor Advisory
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Exploit
• cve@mitre.org
• cve@mitre.org — US Government Resource
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org