CVE-2006-4384

Exp

Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via the COLOR_64 chunk in a FLIC (FLC) movie.

Published: 2006-09-12 Last update: 2026-04-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2006-4384 is rated High Exploit Risk (64.1/100): CVSS Medium severity, with high exploitation likelihood (EPSS 15.25%, 96th percentile). 2 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2006-4384

EDB-ID Source Kind Published Link
28521 exploit_db edb 2006-09-12 Exploit-DB ↗
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2006-4384

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 42.61% 15.25% -27.37%
2 2025-08-15 42.02% 42.61% +0.59%
3 2025-05-01 — 42.02% —

Full EPSS history (13 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2006-4384

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.1 2.0 MEDIUM
AV:N/AC:H/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:H)
Exploitation requires uncommon or highly specific conditions.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 4.9 6.4 [email protected]

Weakness enumeration for CVE-2006-4384

OS Trackers for CVE-2006-4384

vendor priority summary link
gentoo normal CVE-2006-4384: 1 GLSA(s) (200803-08), 1 atom(s) (media-libs/win32codecs); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2006-4384

NVD evaluator notes for CVE-2006-4384

Solution: This vulnerability is addressed in the following product release: Apple, QuickTime Player, 7.1.3

Affected software / configurations for CVE-2006-4384

Vendor Product Version Raw CPE
apple quicktime <= 7.1.2 cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:*
apple quicktime 5.0 cpe:2.3:a:apple:quicktime:5.0:*:*:*:*:*:*:*
apple quicktime 5.0.1 cpe:2.3:a:apple:quicktime:5.0.1:*:*:*:*:*:*:*
apple quicktime 5.0.2 cpe:2.3:a:apple:quicktime:5.0.2:*:*:*:*:*:*:*
apple quicktime 6.0 cpe:2.3:a:apple:quicktime:6.0:*:*:*:*:*:*:*
apple quicktime 6.1 cpe:2.3:a:apple:quicktime:6.1:*:*:*:*:*:*:*
apple quicktime 6.5 cpe:2.3:a:apple:quicktime:6.5:*:*:*:*:*:*:*
apple quicktime 6.5.1 cpe:2.3:a:apple:quicktime:6.5.1:*:*:*:*:*:*:*
apple quicktime 6.5.2 cpe:2.3:a:apple:quicktime:6.5.2:*:*:*:*:*:*:*
apple quicktime 6.5.2 cpe:2.3:a:apple:quicktime:6.5.2:*:mac_os_x_10.2:*:*:*:*:*
apple quicktime 6.5.2 cpe:2.3:a:apple:quicktime:6.5.2:*:mac_os_x_10.3:*:*:*:*:*
apple quicktime 7.0 cpe:2.3:a:apple:quicktime:7.0:*:*:*:*:*:*:*
apple quicktime 7.0 cpe:2.3:a:apple:quicktime:7.0:*:windows:*:*:*:*:*
apple quicktime 7.0.1 cpe:2.3:a:apple:quicktime:7.0.1:*:*:*:*:*:*:*
apple quicktime 7.0.1 cpe:2.3:a:apple:quicktime:7.0.1:*:mac_os_x_10.3:*:*:*:*:*
apple quicktime 7.0.1 cpe:2.3:a:apple:quicktime:7.0.1:*:mac_os_x_10.4:*:*:*:*:*
apple quicktime 7.0.1 cpe:2.3:a:apple:quicktime:7.0.1:*:windows:*:*:*:*:*
apple quicktime 7.0.2 cpe:2.3:a:apple:quicktime:7.0.2:*:*:*:*:*:*:*
apple quicktime 7.0.2 cpe:2.3:a:apple:quicktime:7.0.2:*:windows:*:*:*:*:*
apple quicktime 7.0.3 cpe:2.3:a:apple:quicktime:7.0.3:*:*:*:*:*:*:*
apple quicktime 7.0.4 cpe:2.3:a:apple:quicktime:7.0.4:*:*:*:*:*:*:*
apple quicktime 7.1.1 cpe:2.3:a:apple:quicktime:7.1.1:*:*:*:*:*:*:*

References for CVE-2006-4384

URL Tags
http://docs.info.apple.com/article.html?artnum=304357
http://lists.apple.com/archives/Security-announce/2006/Sep/msg00000.html Patch
http://secunia.com/advisories/21893
http://secunia.com/advisories/29182
http://security.gentoo.org/glsa/glsa-200803-08.xml
http://securityreason.com/securityalert/1554
http://securitytracker.com/id?1016830
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=413 Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/489836 US Government Resource
http://www.osvdb.org/28771
http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=24
http://www.reversemode.com/index.php?option=com_remository&Itemid=2&func=fileinfo&id=25
http://www.securityfocus.com/archive/1/445888/100/0/threaded
http://www.securityfocus.com/archive/1/446134/100/0/threaded
http://www.securityfocus.com/bid/19976 Exploit Patch
http://www.vupen.com/english/advisories/2006/3577
https://exchange.xforce.ibmcloud.com/vulnerabilities/28930
cvelogic Threat Intelligence