About the security content of iTunes 12.6.2 for Windows

This document describes the security content of iTunes 12.6.2 for Windows.

About Apple security updates

For our customers’ protection, Apple doesn’t disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.

Apple security documents reference vulnerabilities by CVE-ID when possible.

iTunes 12.6.2 for Windows

Released July 19, 2017

iTunes

Available for: Windows 7 and later

Impact: An application may be able to execute arbitrary code with system privileges

Description: An access issue was addressed with additional restrictions.

CVE-2017-7053: an anonymous researcher working with Trend Micro’s Zero Day Initiative

libxml2

Available for: Windows 7 and later

Impact: Parsing a maliciously crafted XML document may lead to disclosure of user information

Description: An out-of-bounds read was addressed through improved bounds checking.

CVE-2017-7010: Apple

CVE-2017-7013: found by OSS-Fuzz

WebKit

Available for: Windows 7 and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7018: lokihardt of Google Project Zero

CVE-2017-7020: likemeng of Baidu Security Lab

CVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (蚂蚁金服巴斯光年安全实验室)

CVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (蚂蚁金服巴斯光年安全实验室)

CVE-2017-7037: lokihardt of Google Project Zero

CVE-2017-7039: Ivan Fratric of Google Project Zero

CVE-2017-7040: Ivan Fratric of Google Project Zero

CVE-2017-7041: Ivan Fratric of Google Project Zero

CVE-2017-7042: Ivan Fratric of Google Project Zero

CVE-2017-7043: Ivan Fratric of Google Project Zero

CVE-2017-7046: Ivan Fratric of Google Project Zero

CVE-2017-7048: Ivan Fratric of Google Project Zero

CVE-2017-7052: cc working with Trend Micro’s Zero Day Initiative

CVE-2017-7055: The UK’s National Cyber Security Centre (NCSC)

CVE-2017-7056: lokihardt of Google Project Zero

CVE-2017-7061: lokihardt of Google Project Zero

WebKit

Available for: Windows 7 and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed through improved memory handling.

CVE-2017-7049: Ivan Fratric of Google Project Zero

WebKit

Available for: Windows 7 and later

Impact: An application may be able to read restricted memory

Description: A memory initialization issue was addressed through improved memory handling.

CVE-2017-7064: lokihardt of Google Project Zero

WebKit Page Loading

Available for: Windows 7 and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department

WebKit Web Inspector

Available for: Windows 7 and later

Impact: Processing maliciously crafted web content may lead to arbitrary code execution

Description: Multiple memory corruption issues were addressed with improved memory handling.

CVE-2017-7012: Apple

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: July 19, 2017