{"api_version":"1","generated_at":"2026-07-23T07:36:19+00:00","cve":"CVE-2007-4676","urls":{"html":"https://cve.report/CVE-2007-4676","api":"https://cve.report/api/cve/CVE-2007-4676.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-4676","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-4676"},"summary":{"title":"CVE-2007-4676","description":"Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing (1) Poly type (0x0070 through 0x0074) and (2) PackBitsRgn field (0x0099) opcodes in a PICT image.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-11-07 23:46:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://secunia.com/advisories/27523","name":"http://secunia.com/advisories/27523","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Apple QuickTime Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/26345","name":"http://www.securityfocus.com/bid/26345","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Apple QuickTime PICT Image Remote Multiple Heap Buffer Overflow Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/483311/100/0/threaded","name":"http://www.securityfocus.com/archive/1/483311/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-07-067.html","name":"http://www.zerodayinitiative.com/advisories/ZDI-07-067.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"ZDI-07-067","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/483313/100/0/threaded","name":"http://www.securityfocus.com/archive/1/483313/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"SecurityFocus","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://lists.apple.com/archives/Security-announce/2007/Nov/msg00000.html","name":"http://lists.apple.com/archives/Security-announce/2007/Nov/msg00000.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"APPLE-SA-2007-11-05 QuickTime 7.3","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/38546","name":"http://osvdb.org/38546","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://docs.info.apple.com/article.html?artnum=306896","name":"http://docs.info.apple.com/article.html?artnum=306896","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of QuickTime 7.3","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-310A.html","name":"http://www.us-cert.gov/cas/techalerts/TA07-310A.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"US-CERT Technical Cyber Security Alert TA07-310A -- Apple QuickTime Updates for Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/3351","name":"http://securityreason.com/securityalert/3351","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"CXSecurity - IDS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/690515","name":"http://www.kb.cert.org/vuls/id/690515","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"US-CERT Vulnerability Note VU#690515","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1018894","name":"http://www.securitytracker.com/id?1018894","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"SecurityTracker.com Archives - QuickTime Movie/PICT/QTVR/Java Bugs Let Remote Users Execute Arbitrary Code","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-07-066.html","name":"http://www.zerodayinitiative.com/advisories/ZDI-07-066.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"ZDI-07-066","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38280","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38280","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38281","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38281","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/3723","name":"http://www.vupen.com/english/advisories/2007/3723","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-4676","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-4676","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"4676","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x","cpe6":"10.3.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"4676","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x","cpe6":"10.4.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"4676","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x","cpe6":"10.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"4676","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"quicktime","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"4676","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_vista","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"4676","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows_xp","cpe6":"-","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T15:01:10.101Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-07-066.html"},{"name":"TA07-310A","tags":["third-party-advisory","x_refsource_CERT","x_transferred"],"url":"http://www.us-cert.gov/cas/techalerts/TA07-310A.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://docs.info.apple.com/article.html?artnum=306896"},{"name":"quicktime-packbitsrgn-bo(38280)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38280"},{"name":"3351","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/3351"},{"name":"38546","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/38546"},{"name":"APPLE-SA-2007-11-05","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/Security-announce/2007/Nov/msg00000.html"},{"name":"27523","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/27523"},{"name":"VU#690515","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/690515"},{"name":"20071105 ZDI-07-066: Apple Quicktime PICT File PackBitsRgn Parsing Heap Corruption Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/483311/100/0/threaded"},{"name":"20071105 ZDI-07-067: Apple QuickTime PICT File Poly Opcodes Heap Corruption Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/483313/100/0/threaded"},{"name":"1018894","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1018894"},{"name":"ADV-2007-3723","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/3723"},{"name":"quicktime-poly-type-bo(38281)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38281"},{"name":"26345","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/26345"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-07-067.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-11-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing (1) Poly type (0x0070 through 0x0074) and (2) PackBitsRgn field (0x0099) opcodes in a PICT image."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-15T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-07-066.html"},{"name":"TA07-310A","tags":["third-party-advisory","x_refsource_CERT"],"url":"http://www.us-cert.gov/cas/techalerts/TA07-310A.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://docs.info.apple.com/article.html?artnum=306896"},{"name":"quicktime-packbitsrgn-bo(38280)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38280"},{"name":"3351","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/3351"},{"name":"38546","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/38546"},{"name":"APPLE-SA-2007-11-05","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/Security-announce/2007/Nov/msg00000.html"},{"name":"27523","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/27523"},{"name":"VU#690515","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/690515"},{"name":"20071105 ZDI-07-066: Apple Quicktime PICT File PackBitsRgn Parsing Heap Corruption Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/483311/100/0/threaded"},{"name":"20071105 ZDI-07-067: Apple QuickTime PICT File Poly Opcodes Heap Corruption Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/483313/100/0/threaded"},{"name":"1018894","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1018894"},{"name":"ADV-2007-3723","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/3723"},{"name":"quicktime-poly-type-bo(38281)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38281"},{"name":"26345","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/26345"},{"tags":["x_refsource_MISC"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-07-067.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-4676","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing (1) Poly type (0x0070 through 0x0074) and (2) PackBitsRgn field (0x0099) opcodes in a PICT image."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.zerodayinitiative.com/advisories/ZDI-07-066.html","refsource":"MISC","url":"http://www.zerodayinitiative.com/advisories/ZDI-07-066.html"},{"name":"TA07-310A","refsource":"CERT","url":"http://www.us-cert.gov/cas/techalerts/TA07-310A.html"},{"name":"http://docs.info.apple.com/article.html?artnum=306896","refsource":"CONFIRM","url":"http://docs.info.apple.com/article.html?artnum=306896"},{"name":"quicktime-packbitsrgn-bo(38280)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38280"},{"name":"3351","refsource":"SREASON","url":"http://securityreason.com/securityalert/3351"},{"name":"38546","refsource":"OSVDB","url":"http://osvdb.org/38546"},{"name":"APPLE-SA-2007-11-05","refsource":"APPLE","url":"http://lists.apple.com/archives/Security-announce/2007/Nov/msg00000.html"},{"name":"27523","refsource":"SECUNIA","url":"http://secunia.com/advisories/27523"},{"name":"VU#690515","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/690515"},{"name":"20071105 ZDI-07-066: Apple Quicktime PICT File PackBitsRgn Parsing Heap Corruption Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/483311/100/0/threaded"},{"name":"20071105 ZDI-07-067: Apple QuickTime PICT File Poly Opcodes Heap Corruption Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/483313/100/0/threaded"},{"name":"1018894","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1018894"},{"name":"ADV-2007-3723","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/3723"},{"name":"quicktime-poly-type-bo(38281)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/38281"},{"name":"26345","refsource":"BID","url":"http://www.securityfocus.com/bid/26345"},{"name":"http://www.zerodayinitiative.com/advisories/ZDI-07-067.html","refsource":"MISC","url":"http://www.zerodayinitiative.com/advisories/ZDI-07-067.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-4676","datePublished":"2007-11-07T20:00:00.000Z","dateReserved":"2007-09-05T00:00:00.000Z","dateUpdated":"2024-08-07T15:01:10.101Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-11-07 23:46:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","matchCriteriaId":"04B0096B-6F3A-4193-AD0F-D328A31D087D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:*","matchCriteriaId":"DC6931D5-DE7E-41F6-ADDC-AB5A8A167F69"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*","matchCriteriaId":"8D089858-3AF9-4B82-912D-AA33F25E3715"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:mac_os_x:10.5:*:*:*:*:*:*:*","matchCriteriaId":"D2442D35-7484-43D8-9077-3FDF63104816"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*","matchCriteriaId":"7CAEEA81-5037-4B68-98D9-83AAEBC98E20"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*","matchCriteriaId":"34DF3B5E-F17F-49B4-9DC8-06749F3C9CC3"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"4676","Ordinal":"1","Title":"CVE-2007-4676","CVE":"CVE-2007-4676","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"4676","Ordinal":"1","NoteData":"Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsing (1) Poly type (0x0070 through 0x0074) and (2) PackBitsRgn field (0x0099) opcodes in a PICT image.","Type":"Description","Title":"CVE-2007-4676"},{"CveYear":"2007","CveId":"4676","Ordinal":"2","NoteData":"2007-11-07","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"4676","Ordinal":"3","NoteData":"2018-10-15","Type":"Other","Title":"Modified"}]}}}