CVE-2007-2175

Severity: high (CVSS 7.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 83.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-04-24 · updated 2026-06-16

Description

Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the "PWN 2 0WN" contest at CanSecWest 2007.

Affected products

Apple Safari: all versions

References

http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow
http://docs.info.apple.com/article.html?artnum=305446
http://lists.apple.com/archives/security-announce/2007/May/msg00001.html
http://www.kb.cert.org/vuls/id/420668
http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/
http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/
http://www.osvdb.org/34178
http://www.securityfocus.com/archive/1/467319/100/0/threaded
http://www.securitytracker.com/id?1017950
http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/
http://www.zerodayinitiative.com/advisories/ZDI-07-023.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/33827

Get alerted when CVE-2007-2175 or the next vulnerability affects your stack