KLA11323 Multiple vulnerabilities in Apple iTunes

Multiple serious vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code, bypass security restrictions, perform cross-site scripting attack, read local files.

Below is a complete list of vulnerabilities:

1. Assert failure vulnerability in WebKit can be exploited locally to cause denial of service;
2. Vulnerability related to SecurityErrors can be exploited locally to gain privileges;
3. Vulnerability in WebKit can be exploited remotely via specially crafted website to execute arbitrary code;
4. Vulnerability related to iframe elements can be exploited to bypass security restrictions;
5. A cross-site scripting vulnerability can be exploited to execute scripts in the context of another website;
6. Multiple memory corruption vulnerabilities can be exploited to execute arbitrary code;
7. A cross-site scripting vulnerability can be exploited to read local files.

Original advisories

About the security content of iTunes 12.9 for Windows

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apple-iTunes

CVE list

CVE-2018-4191 high

CVE-2018-4311 high

CVE-2018-4316 high

CVE-2018-4299 high

CVE-2018-4323 high

CVE-2018-4328 high

CVE-2018-4358 high

CVE-2018-4359 high

CVE-2018-4319 high

CVE-2018-4309 warning

CVE-2018-4197 high

CVE-2018-4306 high

CVE-2018-4312 high

CVE-2018-4314 high

CVE-2018-4315 high

CVE-2018-4317 high

CVE-2018-4318 high

CVE-2018-4345 warning

CVE-2018-4361 high

Solution

Update to the latest version

Download iTunes

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• Apple iTunes earlier than 12.9