Lucene search

Kaspersky LabKLA12251

HistoryAug 09, 2021 - 12:00 a.m.

KLA12251 Multiple vulnerabilities in Apple iTunes

2021-08-0900:00:00

Kaspersky Lab

threats.kaspersky.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.5%

JSON

Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to execute arbitrary code.

Below is a complete list of vulnerabilities:

A code execution vulenrability in ImageIO can be exploited via special crafted image to execute arbitrary code.
A buffer overflow vulenrability in ImageIO can be exploited via special crafted image to execute arbitrary code.

Original advisories

About the security content of iTunes 12.11.4 for Windows

Related products

Apple-iTunes

CVE list

CVE-2021-30779 unknown

CVE-2021-30785 unknown

Solution

Update to the latest version

Download iTunes

Impacts

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.