Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

libquicktime 1.2.4 can crash with malicious MP4 files

CVE-2017-9128 · published 9 years ago
Summary

The libquicktime library version 1.2.4 may read beyond its memory limits when it processes a specially crafted MP4 video, causing the application to stop working. This can be triggered by sending a malformed MP4 file to a system that uses this library. Update libquicktime to a newer version or apply the vendor's patch to stop the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
libquicktime libquicktime 1.2.4
cpe:2.3:a:libquicktime:libquicktime:1.2.4:*:*:*:*:*:*:*
Original advisory text
The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp...
The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
4% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published12 Jun 2017
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-9128 · NVD
Track software like this
Free during beta