VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 31, 2010· Updated Apr 29, 2026

CVE-2010-0529

CVE-2010-0529

Description

Heap-based buffer overflow in QuickTime.qts in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a BkPixPat opcode (0x12) containing crafted values that are used in a calculation for memory allocation.

Affected products

22
  • Apple Inc./Quicktime22 versions
    cpe:2.3:a:apple:quicktime:7.0.0:-:windows:*:*:*:*:*+ 21 more
    • cpe:2.3:a:apple:quicktime:7.0.0:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.0.1:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.0.2:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.0.3:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.0.4:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.1.0:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.1.1:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.1.2:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.1.3:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.1.4:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.1.5:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.1.6:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.2.0:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.2.1:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.3.0:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.3.1:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.4.0:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.4.1:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.4.5:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.5.0:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:7.5.5:-:windows:*:*:*:*:*
    • cpe:2.3:a:apple:quicktime:*:-:windows:*:*:*:*:*range: <=7.6.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.