KLA11276 Multiple vulnerabilities in Apple iTunes

Multiple memory corruption vulnerabilities were found in Apple iTunes. By exploiting this vulnerability malicious users can execute arbitrary code and cause denial of service. This vulnerability can be exploited remotely via a specially crafted webpage.

Original advisories

About the security content of iTunes 12.7.1 for Windows

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apple-iTunes

CVE list

CVE-2017-13784 high

CVE-2017-13785 high

CVE-2017-13791 high

CVE-2017-13792 high

CVE-2017-13794 high

CVE-2017-13795 high

CVE-2017-13796 high

CVE-2017-13798 high

CVE-2017-13802 high

CVE-2017-13783 high

CVE-2017-13788 high

CVE-2017-13793 high

CVE-2017-13803 high

Solution

Update to latest version

Download iTunes

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Apple iTunes earlier than 12.7.1