KLA11526 Multiple vulnerabilities in Apple iTunes

Multiple vulnerabilities were found in iTunes. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A stack overflow vulnerability in libxslt can be exploited remotely to obtain sensitive information;
2. Multiple memory corruption vulnerabilities in WebKit can be exploited remotely via specially crafted web content to execute arbitrary code;
3. Multiple logic issues in WebKit can be exploited remotely via specially crafted web content to perform cross-site scripting attacks;

Original advisories

HT210356

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apple-iTunes

CVE list

CVE-2019-8684 critical

CVE-2019-8649 warning

CVE-2019-8686 high

CVE-2019-8678 high

CVE-2019-8673 high

CVE-2019-8688 critical

CVE-2019-8676 critical

CVE-2019-13118 warning

CVE-2019-8690 warning

CVE-2019-8669 critical

CVE-2019-8681 high

CVE-2019-8644 high

CVE-2019-8666 high

CVE-2019-8672 critical

CVE-2019-8658 warning

CVE-2019-8689 critical

CVE-2019-8685 critical

CVE-2019-8679 high

CVE-2019-8677 high

CVE-2019-8671 high

CVE-2019-8680 high

CVE-2019-8687 high

CVE-2019-8683 high

Solution

Update to the latest version

Download iTunes

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Apple iTunes earlier than 12.9.6