Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11276
HistoryOct 31, 2017 - 12:00 a.m.

KLA11276 Multiple vulnerabilities in Apple iTunes

2017-10-3100:00:00
Kaspersky Lab
threats.kaspersky.com
23

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.686 Medium

EPSS

Percentile

97.9%

JSON

Detect date:

10/31/2017

Severity:

High

Description:

Multiple memory corruption vulnerabilities were found in Apple iTunes. By exploiting this vulnerability malicious users can execute arbitrary code and cause denial of service. This vulnerability can be exploited remotely via a specially crafted webpage.

Affected products:

Apple iTunes earlier than 12.7.1

Solution:

Update to latest version
Download iTunes

Original advisories:

About the security content of iTunes 12.7.1 for Windows

Impacts:

ACE

Related products:

Apple iTunes

CVE-IDS:

CVE-2017-137846.8High
CVE-2017-137856.8High
CVE-2017-137916.8High
CVE-2017-137926.8High
CVE-2017-137946.8High
CVE-2017-137956.8High
CVE-2017-137966.8High
CVE-2017-137986.8High
CVE-2017-138026.8High
CVE-2017-137836.8High
CVE-2017-137886.8High
CVE-2017-137936.8High
CVE-2017-138036.8High

Exploitation:

Public exploits exist for this vulnerability.

References

Related

openvas 8
nessus 12
gentoo 1
apple 10
ubuntu 1
kaspersky 1
fedora 3
mageia 1
prion 13
debiancve 13
zdi 1
packetstorm 9
seebug 11
checkpoint_advisories 6
ubuntucve 13
zdt 10
cve 13
freebsd 1
suse 2
openvas
openvas
Ubuntu Update for webkit2gtk USN-3481-1
2017-11-18 00:00:00
Apple iCloud Security Updates( HT208225 )
2017-11-02 00:00:00
Apple iTunes Security Updates( HT208224 )
2017-11-02 00:00:00
nessus
nessus
Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3481-1)
2017-11-17 00:00:00
GLSA-201712-01 : WebKitGTK+: Multiple vulnerabilities
2017-12-15 00:00:00
Apple iTunes < 12.7.1 WebKit Multiple Vulnerabilities (credentialed check)
2017-11-02 00:00:00
gentoo
gentoo
WebKitGTK+: Multiple vulnerabilities
2017-12-14 00:00:00
apple
apple
About the security content of iCloud for Windows 7.1
2017-10-31 00:00:00
About the security content of iCloud for Windows 7.1 - Apple Support
2017-11-02 11:20:27
About the security content of iTunes 12.7.1 for Windows
2017-10-31 00:00:00
ubuntu
ubuntu
WebKitGTK+ vulnerabilities
2017-11-16 00:00:00
kaspersky
kaspersky
KLA11146 Multiple vulnerabilities in Apple Safari
2017-10-31 00:00:00
fedora
fedora
[SECURITY] Fedora 26 Update: webkitgtk4-2.18.3-1.fc26
2017-11-28 16:28:18
[SECURITY] Fedora 25 Update: webkitgtk4-2.18.3-1.fc25
2017-11-28 17:36:01
[SECURITY] Fedora 27 Update: webkitgtk4-2.18.3-1.fc27
2017-11-15 18:00:33
mageia
mageia
Updated webkit2 packages fix security vulnerabilities
2017-11-27 00:18:31
prion
prion
Memory corruption
2017-11-13 03:29:00
Memory corruption
2017-11-13 03:29:00
Memory corruption
2017-11-13 03:29:00
debiancve
debiancve
CVE-2017-13788
2017-11-13 03:29:00
CVE-2017-13793
2017-11-13 03:29:00
CVE-2017-13795
2017-11-13 03:29:00
zdi
zdi
Apple Safari Node Use-After-Free Remote Code Execution Vulnerability
2017-11-20 00:00:00
packetstorm
packetstorm
WebKit WebCore::SVGPatternElement::collectPatternAttributes Out-Of-Bounds Read
2017-11-22 00:00:00
WebKit WebCore::InputType::element Use-After-Free
2017-11-22 00:00:00
WebKit WebCore::DocumentLoader::frameLoader Use-After-Free
2017-11-22 00:00:00
seebug
seebug
WebKit: out-of-bounds read in WebCore::SVGPatternElement::collectPatternAttributes(CVE-2017-13783)
2017-11-23 00:00:00
WebKit: use-after-free in WebCore::InputType::element(CVE-2017-13792)
2017-11-23 00:00:00
WebKit: out-of-bounds read in WebCore::SimpleLineLayout::RunResolver::runForPoint(CVE-2017-13784)
2017-11-23 00:00:00
checkpoint_advisories
checkpoint_advisories
Apple WebKit Use After Free Code Execution (CVE-2017-13792)
2017-11-29 00:00:00
Apple WebKit Use After Free Code Execution (CVE-2017-13791)
2017-11-28 00:00:00
Apple WebKit Use After Free Code Execution (CVE-2017-13796)
2017-12-19 00:00:00
ubuntucve
ubuntucve
CVE-2017-13792
2017-11-12 00:00:00
CVE-2017-13784
2017-11-12 00:00:00
CVE-2017-13798
2017-11-12 00:00:00
zdt
zdt
WebKit - WebCore::AXObjectCache::performDeferredCacheUpdate Use-After-Free Exploit
2017-11-22 00:00:00
WebKit - WebCore::InputType::element Use-After-Free Exploit
2017-11-22 00:00:00
WebKit - WebCore::SimpleLineLayout::RunResolver::runForPoint Out-of-Bounds Read Exploit
2017-11-22 00:00:00
cve
cve
CVE-2017-13795
2017-11-13 03:29:00
CVE-2017-13792
2017-11-13 03:29:00
CVE-2017-13784
2017-11-13 03:29:00
freebsd
freebsd
webkit2-gtk3 -- multiple vulnerabilities
2017-10-18 00:00:00
suse
suse
Security update for webkit2gtk3 (important)
2018-02-01 00:14:30
Security update for webkit2gtk3 (important)
2018-01-25 21:10:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.686 Medium

EPSS

Percentile

97.9%

JSON
Related for KLA11276
openvas8nessus12gentoo1apple10ubuntu1kaspersky1fedora3mageia1prion13debiancve13zdi1packetstorm9seebug11checkpoint_advisories6ubuntucve13zdt10cve13freebsd1suse2