Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-3713: QuickTime on macOS allows remote code execution

CVE-2015-3713 · published 11 years ago

Summary

The QuickTime player built into macOS versions earlier than 10.10.4 can be tricked by a specially crafted video file. An attacker who sends such a file could run their own programs on the computer or crash it. Update macOS to 10.10.4 or later, or replace QuickTime with a newer media player, to protect your system.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
apple	mac_os_x	<= 10.10.3 `cpe:2.3:o:apple:mac_os_x::::::::`
apple	quicktime	All versions `cpe:2.3:a:apple:quicktime::::::::`

Original advisory text

QuickTime in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted movie file.

References

http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html Mailing List Vendor Advisory
http://support.apple.com/kb/HT204942 Vendor Advisory
http://www.securityfocus.com/bid/75493 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032757 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.8 Medium

Exploitation

3% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published3 Jul 2015

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-3713 · NVD

Track software like this

Free during beta