Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusTenable8958.PRM
HistoryOct 23, 2015 - 12:00 a.m.

iTunes for Windows < 12.3 Multiple Vulnerabilities

2015-10-2300:00:00
Tenable
www.tenable.com
20

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.126 Low

EPSS

Percentile

95.5%

JSON

Versions of iTunes earlier than 12.3 are affected by multiple vulnerabilities which include :

  • A flaw exists in Microsoft Foundation Class’s handling of library loading due to the use of a fixed path. An attacker can place a custom version of the file or library in the path, and the program will load it before the legitimate version. Thus, an attacker can leverage this flaw to execute custom code. (CVE-2010-3190)
  • International Components for Unicode for C/C++ (ICU4C) contains several flaws. An overflow condition exists in the resolveImplicitLevels() function in ‘ubidi.c’, which is triggered as user-supplied input is not properly validated. Additionally, an integer truncation flaw exists in the same function in ‘ubidi.c’. Either flaw may allow an attacker to crash an application linked against the library or potentially execute arbitrary code. (CVE-2014-8146, CVE-2014-8147, CVE-2015-5922)
  • A flaw exists in CoreText that is triggered as user-supplied input is not properly validated when handling text and font files. This may allow a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2015-1157, CVE-2015-5874, CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, CVE-2015-5755, CVE-2015-5761)
  • A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-1152, CVE-2015-1153, CVE-2015-3730, CVE-2015-3731, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5796, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5808, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5821, CVE-2015-5822, CVE-2015-5823)
  • An unspecified flaw exists that is triggered during the handling of network connection redirects. This may allow a remote man-in-the-middle attacker to gain access to hashed SMB credential information. (CVE-2015-5920)
Binary data 8958.prm
VendorProductVersionCPE
appleitunescpe:/a:apple:itunes

References

Related

nessus 22
securityvulns 11
openvas 15
kaspersky 1
mageia 3
prion 26
fedora 6
gentoo 1
ubuntu 2
f5 2
exploitpack 1
cert 1
cvelist 27
cve 26
nvd 25
apple 2
exploitdb 1
ubuntucve 18
ibm 2
osv 1
debian 1
debiancve 2
threatpost 1
mskb 1
hp 1
nessus
nessus
Apple iTunes < 12.3 Multiple Vulnerabilities (credentialed check)
2015-09-18 00:00:00
Apple iTunes < 12.3 Multiple Vulnerabilities (uncredentialed check)
2015-10-26 00:00:00
Mac OS X : Apple Safari < 9.0 Multiple Vulnerabilities
2015-10-02 00:00:00
securityvulns
securityvulns
APPLE-SA-2015-09-16-3 iTunes 12.3
2015-10-05 00:00:00
Apple iTunes multiple security vulnerabilities
2015-10-25 00:00:00
APPLE-SA-2015-09-30-2 Safari 9
2015-10-05 00:00:00
openvas
openvas
Apple iTunes Multiple Vulnerabilities (Sep 2015) - Windows
2015-10-01 00:00:00
Apple Safari Multiple Vulnerabilities-01 (Oct 2015) - Mac OS X
2015-10-13 00:00:00
Apple Safari Multiple Vulnerabilities-01 (Sep 2015) - Mac OS X
2015-09-01 00:00:00
kaspersky
kaspersky
KLA10669 Multiple vulnerabilities in Apple iTunes
2015-09-16 00:00:00
mageia
mageia
Updated webkit2 packages fix security vulnerability
2016-03-25 09:38:37
Updated webkit packages fix security vulnerability
2016-03-25 09:38:37
Updated icu package fixes security vulnerabilities
2015-07-27 20:34:09
prion
prion
Memory corruption
2015-08-17 00:00:00
Memory corruption
2015-08-17 00:00:00
Memory corruption
2015-07-03 01:59:00
fedora
fedora
[SECURITY] Fedora 23 Update: webkitgtk-2.4.10-1.fc23
2016-03-22 19:55:11
[SECURITY] Fedora 24 Update: webkitgtk-2.4.10-1.fc24
2016-03-27 00:38:11
[SECURITY] Fedora 23 Update: webkitgtk3-2.4.10-1.fc23
2016-03-21 01:53:49
gentoo
gentoo
International Components for Unicode: Multiple vulnerabilities
2015-07-07 00:00:00
ubuntu
ubuntu
ICU vulnerabilities
2015-05-11 00:00:00
WebKitGTK+ vulnerabilities
2016-03-21 00:00:00
f5
f5
SOL16835 - ICU overflow vulnerabilities CVE-2014-8146 and CVE-2014-8147
2015-07-02 00:00:00
K16835 : ICU overflow vulnerabilities CVE-2014-8146 and CVE-2014-8147
2015-07-02 00:00:00
exploitpack
exploitpack
ICU library 52 54 - Multiple Vulnerabilities
2015-06-10 00:00:00
cert
cert
ICU Project ICU4C library contains multiple overflow vulnerabilities
2015-05-04 00:00:00
cvelist
cvelist
CVE-2015-5755
2015-08-16 23:00:00
CVE-2015-5761
2015-08-16 23:00:00
CVE-2015-3688
2015-07-03 01:00:00
cve
cve
CVE-2015-5761
2015-08-17 00:00:44
CVE-2015-5755
2015-08-17 00:00:36
CVE-2015-3685
2015-07-03 01:59:40
nvd
nvd
CVE-2015-5761
2015-08-17 00:00:44
CVE-2015-5755
2015-08-17 00:00:36
CVE-2015-3685
2015-07-03 01:59:40
apple
apple
About the security content of Apple TV 7.2.1 - Apple Support
2017-01-23 03:54:31
About the security content of Apple TV 7.2.1
2016-02-25 00:00:00
exploitdb
exploitdb
ICU library 52 &lt; 54 - Multiple Vulnerabilities
2015-06-10 00:00:00
ubuntucve
ubuntucve
CVE-2015-1154
2015-05-08 00:00:00
CVE-2015-1153
2015-05-07 00:00:00
CVE-2015-1152
2015-05-08 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in ICU libraries used in IBM DataPower Gateway
2021-09-10 14:15:27
Security Bulletin: IBM DataPower Gateway Virtual Edition uses out of date ICU libraries in open-vm-tools
2022-06-02 12:50:09
osv
osv
icu - security update
2015-08-01 00:00:00
debian
debian
[SECURITY] [DSA 3323-1] icu security update
2015-08-01 16:07:55
debiancve
debiancve
CVE-2014-8146
2015-05-25 22:59:00
CVE-2014-8147
2015-05-25 22:59:01
threatpost
threatpost
ICU Project ICU4C Library Vulnerabilities Patched
2015-05-05 11:21:07
mskb
mskb
MS11-025: Vulnerability in Microsoft Foundation Class (MFC) Library could allow remote code execution: April 12, 2011
2011-04-12 00:00:00
hp
hp
HPSBPI03720 rev. 1 - Software Vulnerability with Certain HP OfficeJet and PageWide Solutions
2021-03-09 00:00:00

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.126 Low

EPSS

Percentile

95.5%

JSON
Related for 8958.PRM
nessus22securityvulns11openvas15kaspersky1mageia3prion26fedora6gentoo1ubuntu2f52exploitpack1cert1cvelist27cve26nvd25apple2exploitdb1ubuntucve18ibm2osv1debian1debiancve2threatpost1mskb1hp1