CVE-2006-4965

no score yetEPSS 13%

Apple QuickTime 7.1.3 Player and Plug-In allows remote attackers to execute arbitrary JavaScript code and possibly conduct other attacks via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter that identifies resources outside of the original domain. NOTE: as of 20070912, this issue has been demonstrated by using instances of Components.interfaces.nsILocalFile and Components.interfaces.nsIProcess to execute arbitrary local files within Firefox and possibly Internet Explorer.

EPSS: 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2006-09-25
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

apple:quicktime

References

http://docs.info.apple.com/article.html?artnum=305149
http://lists.apple.com/archives/Security-announce/2007/Mar/msg00000.html
http://secunia.com/advisories/22048
http://secunia.com/advisories/27414
http://securityreason.com/securityalert/1631

Check your stack JSON