8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
This document describes the security content of iTunes 12.7.4 for Windows.
For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.
For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.
Apple security documents reference vulnerabilities by CVE-ID when possible.
Released March 29, 2018
Security
Available for: Windows 7 and later
Impact: A malicious application may be able to elevate privileges
Description: A buffer overflow was addressed with improved size validation.
CVE-2018-4144: Abraham Masri (@cheesecakeufo)
WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
CVE-2018-4101: Yuan Deng of Ant-financial Light-Year Security Lab
CVE-2018-4114: found by OSS-Fuzz
CVE-2018-4118: Jun Kokatsu (@shhnjk)
CVE-2018-4119: an anonymous researcher working with Trend Micro’s Zero Day Initiative
CVE-2018-4120: Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team
CVE-2018-4121: natashenka of Google Project Zero
CVE-2018-4122: WanderingGlitch of Trend Micro’s Zero Day Initiative
CVE-2018-4125: WanderingGlitch of Trend Micro’s Zero Day Initiative
CVE-2018-4127: an anonymous researcher working with Trend Micro’s Zero Day Initiative
CVE-2018-4128: Zach Markley
CVE-2018-4129: likemeng of Baidu Security Lab working with Trend Micro’s Zero Day Initiative
CVE-2018-4130: Omair working with Trend Micro’s Zero Day Initiative
CVE-2018-4161: WanderingGlitch of Trend Micro’s Zero Day Initiative
CVE-2018-4162: WanderingGlitch of Trend Micro’s Zero Day Initiative
CVE-2018-4163: WanderingGlitch of Trend Micro’s Zero Day Initiative
CVE-2018-4165: Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan Team
WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction with indexing types causing an ASSERT failure
Description: An array indexing issue existed in the handling of a function in javascript core. This issue was addressed through improved checks.
CVE-2018-4113: found by OSS-Fuzz
WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to a denial of service
Description: A memory corruption issue was addressed through improved input validation.
CVE-2018-4146: found by OSS-Fuzz
WebKit
Available for: Windows 7 and later
Impact: A malicious website may exfiltrate data cross-origin
Description: A cross-origin issue existed with the fetch API. This was addressed through improved input validation.
CVE-2018-4117: an anonymous researcher, an anonymous researcher
WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: This issue was addressed with improved checks.
CVE-2018-4207: found by OSS-Fuzz
Entry added May 2, 2018
WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: This issue was addressed with improved checks.
CVE-2018-4208: found by OSS-Fuzz
Entry added May 2, 2018
WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: This issue was addressed with improved checks.
CVE-2018-4209: found by OSS-Fuzz
Entry added May 2, 2018
WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction with indexing types caused a failure
Description: An array indexing issue existed in the handling of a function in javascript core. This issue was addressed with improved checks.
CVE-2018-4210: found by OSS-Fuzz
Entry added May 2, 2018
WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: This issue was addressed with improved checks.
CVE-2018-4212: found by OSS-Fuzz
Entry added May 2, 2018
WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: This issue was addressed with improved checks.
CVE-2018-4213: found by OSS-Fuzz
Entry added May 2, 2018
Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.
Published Date: March 05, 2021
CPE | Name | Operator | Version |
---|---|---|---|
itunes for windows | lt | 12.7.4 |
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C