PatchTheCVElibquicktime vulnerabilities and fixes
Recent CVEs affecting libquicktime, with upgrade or downgrade steps. 10 tracked.
libquicktime has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2017-08-02. Highest priority: CVE-2016-2399 (score 56/100).
- CVE-2017-9128 MEDIUM 6.5 DOWNGRADE The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a
- CVE-2017-9127 MEDIUM 6.5 DOWNGRADE The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to ca
- CVE-2017-9126 MEDIUM 6.5 DOWNGRADE The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a deni
- CVE-2017-9125 MEDIUM 6.5 DOWNGRADE The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a de
- CVE-2017-9124 MEDIUM 6.5 DOWNGRADE The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of s
- CVE-2017-9123 MEDIUM 6.5 DOWNGRADE The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a de
- CVE-2017-9122 MEDIUM 6.5 DOWNGRADE The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of
- CVE-2017-12145 MEDIUM 6.5 DOWNGRADE In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_ftyp in ftyp.c, which al
- CVE-2017-12143 MEDIUM 6.5 DOWNGRADE In libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_info in lqt_quicktime.c,
- CVE-2016-2399 HIGH 7.8 UPGRADE Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attacke
FAQ
How do I fix libquicktime vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libquicktime being exploited right now?
None of the tracked libquicktime CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libquicktime CVE should I patch first?
CVE-2016-2399 currently ranks highest (56/100): Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attacke.