Multiple vulnerabilities in Apple iTunes

説明

Multiple serious vulnerabilities have been found in Apple iTunes. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code and bypass security restrictions.

Below is a complete list of vulnerabilities:

1. An unknown vulnerability in CFNetwork can be exploited locally to obtain sensitive information;
2. Multiple memory corruption vulnerabilities in WebKit can be exploited remotely to execute arbitrary code;
3. A CORS (cross-origin resource sharing) vulnerability can be exploited remotely to bypass security restrictions;
4. A type confusion vulnerability in WebKit can be exploited remotely to execute arbitrary code;
5. A race condition vulnerability in WebKit can be exploited remotely to cause denial of service;
6. Multiple memory corruption vulnerabilities in WebKit can be exploited remotely to cause denial of service.

オリジナルアドバイザリー

• About the security content of iTunes 12.8 for Windows

エクスプロイテーション

Public exploits exist for this vulnerability.

関連製品

• Apple-iTunes

CVEリスト

• CVE-2018-4293
  high
• CVE-2018-4270
  high
• CVE-2018-4278
  warning
• CVE-2018-4284
  critical
• CVE-2018-4266
  high
• CVE-2018-4261
  critical
• CVE-2018-4262
  critical
• CVE-2018-4263
  critical
• CVE-2018-4264
  critical
• CVE-2018-4265
  critical
• CVE-2018-4267
  critical
• CVE-2018-4272
  critical
• CVE-2018-4271
  high
• CVE-2018-4273
  high

も参照してください

お住まいの地域に広がる脆弱性の統計をご覧ください statistics.securelist.com