KLA11292 Multiple vulnerabilities in Apple iTunes

Multiple serious vulnerabilities have been found in Apple iTunes. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code and bypass security restrictions.

Below is a complete list of vulnerabilities:

1. An unknown vulnerability in CFNetwork can be exploited locally to obtain sensitive information;
2. Multiple memory corruption vulnerabilities in WebKit can be exploited remotely to execute arbitrary code;
3. A CORS (cross-origin resource sharing) vulnerability can be exploited remotely to bypass security restrictions;
4. A type confusion vulnerability in WebKit can be exploited remotely to execute arbitrary code;
5. A race condition vulnerability in WebKit can be exploited remotely to cause denial of service;
6. Multiple memory corruption vulnerabilities in WebKit can be exploited remotely to cause denial of service.

Original advisories

About the security content of iTunes 12.8 for Windows

Related products

Apple-iTunes

CVE list

CVE-2018-4293 warning

CVE-2018-4270 warning

CVE-2018-4278 warning

CVE-2018-4284 high

CVE-2018-4266 warning

CVE-2018-4261 high

CVE-2018-4262 high

CVE-2018-4263 high

CVE-2018-4264 high

CVE-2018-4265 high

CVE-2018-4267 high

CVE-2018-4272 high

CVE-2018-4271 warning

CVE-2018-4273 warning

Solution

Update to the latest version

Download iTunes

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Apple iTunes earlier than 12.8