Format String Vulnerability in iMovie HD and Safari by Apple

CVE-2007-0646

Summary

A format string vulnerability exists in iMovie HD 6.0.3 and Safari on Mac OS X versions 10.4 through 10.4.10. This vulnerability allows remote user-assisted attackers to exploit the application by crafting specific filenames that include format string specifiers. When the NSRunCriticalAlertPanel function is called with improperly handled inputs, it can result in a crash of the application, leading to a denial of service. Users are advised to avoid opening files from untrusted sources and to apply security updates provided by Apple.

References