KLA11489 Multiple vulnerabilities in iTunes

Multiple vulnerabilities were found in iTunes. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, gain privileges.

Below is a complete list of vulnerabilities:

1. An out-of-bounds read vulnerability in WebKit can be exploited remotely to obtain sensitive information;
2. Multiple memory corruption vulnerabilities in WebKit can be exploited remotely to execute arbitrary code;
3. An input validation issue in SQLite can be exploited remotely to gain privileges;
4. A memory corruption vulnerability in SQLite can be exploited to execute arbitrary code;
5. An input validation issue in SQLite can be exploited remotely to obtain sensitive information;
6. A memory corruption vulnerability in SQLite can be exploited to gain privileges;

Original advisories

HT210124

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apple-iTunes

CVE list

CVE-2019-8601 high

CVE-2019-8628 high

CVE-2019-8597 warning

CVE-2019-8610 high

CVE-2019-8622 high

CVE-2019-8607 warning

CVE-2019-8571 high

CVE-2019-8586 high

CVE-2019-8583 high

CVE-2019-8611 high

CVE-2019-8615 warning

CVE-2019-8594 high

CVE-2019-8595 high

CVE-2019-8584 high

CVE-2019-6237 high

CVE-2019-8577 high

CVE-2019-8600 critical

CVE-2019-8623 high

CVE-2019-8598 warning

CVE-2019-8608 high

CVE-2019-8619 high

CVE-2019-8602 high

CVE-2019-8587 high

CVE-2019-8596 high

CVE-2019-8609 high

CVE-2019-8582 warning

Solution

Update to the latest version

Download iTunes

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• ITunes version 12.9.5