Description
Apple QuickTime for Java 7.1.6 on Mac OS X and Windows does not properly restrict QTObject subclassing, which allows remote attackers to execute arbitrary code via a web page containing a user-defined class that accesses unsafe functions that can be leveraged to write to arbitrary memory locations.
References
- APPLE-SA-2007-05-29 vendor-advisory
- ADV-2007-1974 vdb-entry
- 1018136 vdb-entry
- VU#995836 third-party-advisory
- 35576 vdb-entry
- 25130 third-party-advisory
- 24221 vdb-entry
- http://secunia.com/secunia_research/2007-52/advisory/