{"id":"CVE-2007-2175","url":"https://www.cyber-defence.io/tools/cve/CVE-2007-2175","generatedAt":"2026-10-27T18:32:17.110Z","title":"Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to…","description":"Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointerRef objects, as demonstrated during the \"PWN 2 0WN\" contest at CanSecWest 2007.","published":"2007-04-24T16:19:00.000Z","lastModified":"2026-06-16T22:39:05.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":7.6,"severity":"HIGH","vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C"},"cwe":[],"affected":["apple/safari"],"epss":{"score":0.83804,"percentile":0.99686,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":3,"verified":true,"firstPublished":"2007-04-23","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":16295,"kind":"exploit","title":"Apple QTJava - 'toQTPointer()' Arbitrary Memory Access (Metasploit)","url":"https://www.exploit-db.com/exploits/16295","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/16295.rb","file":"exploits/multiple/remote/16295.rb","published":"2010-09-20","added":"2010-09-20","updated":"2011-03-06","author":"Metasploit","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["CVE-2007-2175","OSVDB-34178"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"http://www.zerodayinitiative.com/advisories/ZDI-07-023.html"},{"edbId":29884,"kind":"exploit","title":"Apple QuickTime 7.1.5 - QTJava toQTPointer() Java Handling Arbitrary Code Execution","url":"https://www.exploit-db.com/exploits/29884","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/29884.txt","file":"exploits/multiple/remote/29884.txt","published":"2007-04-23","added":"2007-04-23","updated":"2013-11-29","author":"Shane Macaulay","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["CVE-2007-2175","OSVDB-34178"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/23608/info"},{"edbId":9943,"kind":"exploit","title":"Apple QuickTime for Java 7 - Memory Access (Metasploit)","url":"https://www.exploit-db.com/exploits/9943","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/9943.rb","file":"exploits/multiple/remote/9943.rb","published":"2007-04-23","added":"2007-04-22","updated":null,"author":"H D Moore","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["CVE-2007-2175","OSVDB-34178"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"http://www.zerodayinitiative.com/advisories/ZDI-07-023.html"}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 83.8%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow","source":"cve@mitre.org"},{"url":"http://docs.info.apple.com/article.html?artnum=305446","source":"cve@mitre.org"},{"url":"http://lists.apple.com/archives/security-announce/2007/May/msg00001.html","source":"cve@mitre.org"},{"url":"http://www.kb.cert.org/vuls/id/420668","tags":["US Government Resource"],"source":"cve@mitre.org"},{"url":"http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/","source":"cve@mitre.org"},{"url":"http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34178","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/467319/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securitytracker.com/id?1017950","source":"cve@mitre.org"},{"url":"http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/","source":"cve@mitre.org"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-07-023.html","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33827","source":"cve@mitre.org"},{"url":"http://cansecwest.com/post/2007-04-20-14:54:00.First_Mac_Hacked_Cancel_Or_Allow","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://docs.info.apple.com/article.html?artnum=305446","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.apple.com/archives/security-announce/2007/May/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.kb.cert.org/vuls/id/420668","tags":["US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.matasano.com/log/806/hot-off-the-matasano-sms-queue-cansec-macbook-challenge-won/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.matasano.com/log/812/breaking-macbook-vuln-in-quicktime-affects-win32-apple-code/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34178","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/467319/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id?1017950","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-07-023.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33827","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-2175","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}